Welfare Reform and Substance 
Abuse Treatment 
Confidentiality: 

General G uidancefor 
Reconciling 

Need to Know and Privacy 


Technical Assistance Publication Series 

24 


U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES 
Public Health Service 

Substance Abuse and Mental Health Services Administration 
Center for Substance Abuse Treatment 

Rockwall II, 5600 Fishers Lane 
Rockville, MD 20857 



This publication is part of the Substance 
Abuse Prevention and Treatment Block 
Grant technical assistance program. All 
material appearing in this volume except 
quoted passages from copyrighted sources 
is in the public domain and may be 
reproduced or copied without permission 
from the Center for Substance Abuse 
Treatment (CSAT) or the author. Citation 
of the source is appreciated. 

This publication was written by the Legal 
Action Center under contract 270-96-0005 
from the Substance Abuse and Mental 
Health Administration (SAMHSA). Nancy 
S. Kilpatrick, M.A., of CSAT served as 
the Government project officer. The 
principal authors were Paul N. Samuels, 


Esq., and Anita R. Marton, Esq., Judith 
Galloway, Esq., Sharon K. Amatetti, 
M.P.H., and Kerry Kemp provided 
editorial support. 

The opinions expressed herein are the 
views of the author and do not necessarily 
reflect the official position of CSAT or any 
other part of the U.S. Department of 
Health and Human Services (DHHS). 

DHSS Publication No. (SMA) 99-3332 
Printed 1999 


li 



Contents 


Foreword. v 

I. Introduction . 1 

II. Confidentiality of Alcohol and Drug Abuse 

Patient Records: The Basics. 2 

III. Confidentiality and Welfare: The Key Areas .3 

1. Disclosure of Substance Abuse Diagnosis and Treatment 

Information From the Treatment System to the Welfare System. 3 

2. Disclosure of Substance Abuse Testing and Screening Information 

from the Welfare System to the Treatment System. 5 

3. Reporting of Attendance in—and Failure To Attend—Substance 

Abuse Programs to the Welfare System. 6 

4. Patient/Client Revocation of Consent. 7 

5. Reporting a Substance Abuse Patient's Relapse to the Welfare System. 7 

6. Combined Case Planning Between Substance Abuse Staff 

and Welfare Caseworkers. 8 

7. Qualified Service Organization Agreements Between Treatment 

and Welfare Systems. 9 

IV. Essential Considerations .10 

1. Relationship with State Law. 10 

2. Assistance of Legal Counsel . 10 

Appendix A—The Federal Confidentiality Law and Regulations A-l 

Appendix B—Sample Forms and Agreements To 
Facilitate Collaborative Efforts Between the 
Substance Abuse Treatment and Welfare 

Systems. B-l 




















Foreword 

The need for this guidance emerged from a series of 
four regional State Team-Building Workshops held 
on welfare reform and its relationship to substance 
abuse treatment. These workshops, sponsored by 
the Center for Substance Abuse Treatment’s (CSAT) 
Division of State and Community Assistance, were 
conducted from July through October 1997. They 
were attended by repre- sentatives of both substance 
abuse treatment and welfare systems within each 
participating State. These representatives identified 
a mutual goal at the workshops: namely, assisting 
shared clients in overcoming substance abuse issues 
which create barriers to the clients’ ability to work. 

The Personal Responsibility and Work Opportunity 
Reconciliation Act of 1996 (PRWA) (Public Law 
104-193) has challenged States to help their citi-zens 
leave welfare and become employed. As a 
consequence. States are now trying harder than ever 
to prepare welfare clients to enter and succeed in the 
workforce. Among the barriers to work identified in 
research regarding we I fare clients are drug and 
alcohol problems. This Technical Assistance 
Publication (TAP) provides broad guidance on how 
two systems—the substance abuse treatment and 
welfare systems—can share information on their 
mutual clients. 

The goal of this TAP is to assist State alcohol and 
other drug agencies, substance abuse treatment 
providers, and welfare officials in addressing 
confidentiality issues with respect to these shared 
clients. It fa mi liarizes we I fare agency staff with 
protections about which they may be unaware. It 
discusses key issues such as how and when 
disclosure is possible and it provides practical tips to 
surmount real or perceived obstacles. 

Confidentiality laws relating to treatment for 
substance abuse—defined as abuse of alcohol or 
other drugs—were originally enacted to encourage 
substance abusers to seek assistance without fear of 
public disclosure of their abuse, including disclosure 
of records of their treatment that could attach for life. 
Federal regulations that protect the identities of 
persons in substance abuse treatment have their 
genesis in two statutes of the early 1970's: first, the 
Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment and Rehabilitation Act of 


1970; and second, the Drug Abuse Prevention, 
Treatment and Rehabilitation Act of 1972. These 
two statutes were implemented by regulations issued 
in 1975 by the U.S. Department of Health, 
Education, and Welfare (DHEW). Revised in 1987 
by DHEW’s successor, the U.S. Department of 
Health and Human Services, the regulations are set 
out at title 42, part 2, of the Code of Federal 
Regulations. 

The confidentiality statutes and regulations were later 
consolidated by Congress within the Public Health 
Service Act—now title 42, section 290dd-3 of the 
United States Code (42 U.S.C. §290dd-2). In this 
TAP, references to the confidentiality law or 
regulations mean the regulations at title 42, paid 2, of 
the Code of Federal Regulations (42 CFR Part 2). 
The Federal confidentiality law and regulations are 
presented as Appendix A. 

On behalf of the Center for Substance Abuse 
Treatment of the Substance Abuse and Mental 
Health Services Administration, I hope that this TAP 
will promote compliance with the Federal 
confidentiality regulations by both substance abuse 
treatment and welfare officials, as well as facilitate 
interactions between the two systems. 

H. Westley Clark, M.D., J.D., M.P.H., CAS, 
FASAM 
Director 

Center for Substance Abuse Treatment 
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I. Introduction 

The purpose of this document is to provide guidance 
in resolving issues related to the confidentiality of 
patient/client information that are faced by alcohol 
and other drug agencies, substance abuse treatment 
providers, and welfare officials charged with 
implementing State responses to the Personal 
Responsibility and Work Opportunity Reconciliation 
Act of 1996 (PRWA) (Public Law 104-193). These 
parties confront several issues related to 
confidentiality as they collaborate in helping their 
shared clients overcome substance abuse problems 
that create barriers to the clients’ ability to work. 

The Federal alcohol and drug confidentiality law 
requires covered programs that provide alcohol or 
drug abuse diagnosis, treatment, or referral for 
treatment to strictly maintain the confidentiality of 
substance abuse patient records. This law (42 
U.S.C. §290dd-2) and its accompanying regulations 
(42 CFR Part 2) came about because the U.S. 
Congress recognized that these safeguards on privacy 
serve the important purpose of encouraging persons 
to seek treatment by preventing the disclosure of 
information related to their substance abuse diagnosis 
and treatment. (For the full text of the Federal law 
and regulations, see Appendix A.) 

The Federal confidentiality law and regulations have 
proved to be both remarkably effective and practical 
in protecting patients from the potential harm of 
unwarranted disclosures while permitting the release 
of information in appropriate circumstances. 
Increasingly, however, the substance abuse treatment 
field is being called upon to interact and communicate 
with outside entities, including staff of welfare 
agencies who are not familiar with these protections 
or how to utilize 
the provisions authorizing appropriate 
disclosures. 

The PRWA has challenged States to help their 
citizens leave welfare and enter the workforce. In 
order to do this, States are having to help "harder-to- 
serve" welfare clients prepare to enter—and succeed 
in—the workforce. Among the barriers facing such 
clients identified in the research are 
drug and alcohol problems. 


Both welfare clients and officials believe that 
treatment services are important to welfare reform. 
Providing substance abuse treatment and prevention 
services can help States meet their welfare reform 
goals both by moving substance abusing welfare 
recipients to sobriety/work and by averting inter- 
generational substance and welfare dependence 
among young people. As a result, both systems 
increasingly understand and appreciate the benefits 
that will accrue from working together effectively. 

For a successful collaboration between substance 
abuse services and welfare systems to occur, both 
systems must address the implications of the Federal 
confidentiality law for communication of patient 
information. How can necessary disclosures be made 
between the two systems without violating the 
confidentiality rules? 

This document promotes and facilitates compliance 
with the Federal confidentiality law by both 
substance abuse and welfare agencies, while 
permitting communication and linkages between the 
substance abuse and adult welfare systems essential 
to successful implementation of welfare reform. 

This document was developed for the following 
audiences: 

C staff of State agencies responsible for funding 
and evaluating substance abuse treatment and 
prevention programs; 

C staff of substance abuse treatment and pre¬ 
vention programs, including clinical directors, 
counselors, nurses and administrative personnel; 
and 

C welfare officials responsible for interacting with 
welfare recipients with or at risk for substance 
abuse problems. 
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The document describes the basic provisions of 
Federal confidentiality law and outlines the key 
confidentiality issues pertaining to the substance 
abuse treatment system and the welfare system. 
The Federal confidentiality law and regulations are 
presented in Appendix A; sample patient consent and 
other forms are presented in Appendix 
B. 

The Federal confidentiality law discussed here 
applies only to substance abuse patient records and 
not to records of other health or mental health 
services. For example, the child welfare system is 
also undergoing change nationally, but confidenti¬ 
ality issues pertaining exclusively to clients within 
that system are not included in the scope of this 
guidance. 

II. Confidentiality of 
Alcohol and Drug Abuse 
Patient Records: The 
Basics 

Federal law (42 U.S.C. §290dd-2) and regulations 
(42 CFR Part 2) afford substance abuse treatment 
client records special privacy protection out of 
recognition that the confidentiality of such records 
must be scrupulously protected if individuals are to 
be encouraged to enter and stay in treatment. 

These are the basic provisions of the Federal 
confidentiality law and regulations: 

C Except under certain specified conditions, there is 
a prohibition on disclosure of records or other 
information concerning a patient in a Federally 
assisted program. (See 42 CFR §2.11 for 
definition of “program” and §2.12(b) for the 
meaning of “Federally assisted.”) The prohibition 
applies regardless of whether the person seeking 
the information already has it, has other means of 
obtaining it, enjoys official status, has obtained a 
subpoena or even a warrant, or is authorized by 
State law (42 CFR §2.13(b)). 

C Under certain conditions, limited disclosures are 
permitted. These fall into nine categories: (1) 
when there is written consent from the patient; 


(2) when the disclosures are for the purpose of 
internal communications; (3) when there is no 
patient-identifying information; (4) when there is a 
medical emergency; (5) when there is a court 
order; (6) when the person involved has committed 
a crime at program or against program personnel; 
(7) when the disclosure is for research/audit and 
evaluation; (8) when the disclosure is for child 
abuse and neglect reporting; and (9) when there is 
a Qualified Service Organization agreement 
(QSOA). 

C Most disclosures are permissible if a patient has 
signed a valid consent form that has not expired or 
been revoked. A proper patient consent form must 
be in writing and contain each of the following nine 
elements (42 CFR §2.31): 

1. the name of the program making the 
disclosure; 

2. the name of the individual or organization 
that will receive the disclosure; 

3. the name of the patient; 

4. the purpose or need for the disclosure; 

5. how much and what kind of information 
will be disclosed; 

6. a statement that the patient may revoke the 
consent at any time; 

7. the date, event, or condition upon which 
consent expires if not revoked; 

8. the signature of the patient; and 

9. the date on which the consent is signed. 
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General release forms and other forms that do not 
contain all the above nine elements are not valid 
for the purpose of authorizing disclosure of 
substance abuse patient records. 

C Familiarity with the Federal confidentiality 
provisions is essential to anyone directly or 
indirectly involved with substance abuse 
treatment, because the unknowing proceed at peril 
of criminal and civil liability. Violating the 
regulations is punishable by a fine of up to $500 
for a first offense or up to $5,000 for each 
subsequent offense (42 CFR §2.4). 

III. Confidentiality and 
Welfare: The Key Areas 

It is essential to understand that the Federal 
confidentiality law and regulations do peimit 
disclosures to the welfare system of the records of 
patients receiving substance abuse treatment in most 
circumstances, as long as the Federal confidentiality 
requirements are followed scrupulously. Typically, 
this means obtaining the written consent of the 
patient to authorize the disclosure. Key areas for 
welfare caseworkers and substance abuse treatment 
providers who work with welfare recipients are 
discussed further below: 

C disclosure of substance abuse diagnosis and 
treatment information from the treatment system 
to the welfare system; 

C disclosure of substance abuse testing and 
screening information from the welfare system to 
the treatment system; 

C reporting of attendance in—and failure to 
attend—a substance abuse treatment program to 
the welfare system; 

C patient/client revocation of consent; 


C reporting a substance abuse patient’s relapse to 
the welfare system; 

C combined case planning between substance abuse 
staff and welfare caseworkers; 
and 

C Qualified Service Organization agreements 
(QSOAs) between treatment and welfare systems. 

1. Disclosure of Substance Abuse 
Diagnosis and Treatment 
Information From the Treatment 
System to the Welfare System 

Information concerning a patient’s diagnosis and 
treatment is covered by the Federal 
confidentiality law and regulations; disclosure 
can be made only with the patient’s written 
consent or other appropriate legal authorization. 

The Federal confidentiality law and regulations state 
that information obtained by Federally assisted 
substance abuse programs regarding an individual’s 
substance abuse drug treatment, and the “diagnosis” 
of a patient’s substance abuse (defined as “any 
reference to an individual’s alcohol or drug abuse or 
to a condition which is identified as having been 
caused by that abuse which is made for the purpose 
of treatment or referral for treatment”), are covered 
by the confidentiality protections (42 CFR §2.11 and 
2.12(a)(ii)). Thus, a substance abuse program must 
obtain the written consent of the patient or obtain 
other authorization, as prescribed by the law and 
regulations, before it can make any disclosure of 
information related to treatment and/or a 
diagnosis. 

Substance abuse programs can disclose to the welfare 
system information about treatment services only 
with the written consent of the patient (42 CFR 
Subpart C) or with other authorization such as a 
court order issued in accordance with 42 CFR 
Subpart D. Similarly, whenever a treatment program 
makes a diagnosis (or “clinical assessment”) to 
determine if an individual has a substance abuse 
problem, it can communicate information related to 
that diagnosis to the welfare system only with the 
written consent of the patient or with other 
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authorization. These rules remain in force even if the 
welfare system referred the individual for diagnosis 
and treatment, and even if the welfare system 
mandated the individual to obtain one or both of 
those services. 

In the great majority of situations involving 
communication of treatment or diagnostic 
information, written consent will be the vehicle that 
authorizes disclosure of information from the 
substance abuse treatment provider to the welfare 
agency. Written consent is valid for the purpose of 
authorizing disclosure of substance abuse patient 
information covered by the Federal confidentiality 
law only if it contains all nine elements required by 
§2.31 of the regulations (see discussion above). 

Section 2.12(a)(1) states that the confidentiality 
law and regulations govern information disclosed 
by a “Federally assisted drug abuse.,.or...alcohol 
abuse program.” In addition, §2.11 defines a 
covered “program” as “an individual or entity. . . 
who holds itself out as providing, and provides, 
alcohol or drug abuse diagnosis, treatment, or 
referral for treatment. . .” 

A patient consent form that would authorize a 
treatment program to communicate information 
concerning the diagnosis and treatment of 
substance abuse to the welfare system is presented 
in Appendix B (Sample Form #1). 

In some jurisdictions, the welfare agency itself 
employs specialists in substance abuse problems who 
assess and diagnose welfare recipients and then refer 


Practical Tip: As long as the patient consent 
form contains all nine elements required by the 
Federal confidentiality law and regulations, it does 
not matter who presented the form to the patient 
for signature. Thus, the welfare and substance 
abuse treatment systems could collaborate on the 
development of a common form and then use 
that form routinely whenever information will be 
needed. The welfare system could have the 
patient sign the form whenever it refers recipients 
to treatment or requires that an individual receive 
treatment in order to receive welfare. The 
treatment system could rely on that same 
consent to disclose back to the welfare agency. 


those with substance abuse problems to treatment. 
Such specialists are covered by the Federal 
confidentiality law and regulations, so they would 
need consent forms signed by the individuals they 
diagnose before the results could be communicated to 
any other section of the wel fare agency. 

The welfare and treatment systems can work 
together to enhance their ability to obtain consent 
and minimize confusion and misunderstanding. 

A little collaboration can go a long way in reducing 
confusion and improving the working relationships 
between the welfare and substance abuse treatment 
systems. 


Practical Tip: Only the party (or parties) 
named on a consent form can obtain information 
from the treatment program, directly or indirectly. 
Thus, if a welfare case worker wishes to disclose 
to another party information obtained via a 
consent form, the case worker would need to 
obtain, from the client, an additional consent form 
permitting the specific disclosure before making 
the redisclosure. The best way to avoid these 
types of paperwork headaches is to make sure 
that everyone who will need to receive the 
information is listed (by name or descriptively) on 
the initial consent form. The Federal regulations 
allow consent forms to authorize disclosures to 
multiple parties where all the other elements are 
identical. A multiparty consent form is presented 
in Appendix B (Sample Form #2). 
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Whenever a disclosure is made with the patient’s 
written consent, the treatment program making the 
disclosure must include with the information 
conveyed a notice that redisclosure is prohibited 
without further authorization. Such a notice is 
presented in Appendix B (Sample Form #3). The 
prohibition does not apply to sharing the information 
with others within the we I fare agency who are 
included as recipients on the consent form. 

2. Disclosure of Substance Abuse 
Testing and Screening Information 
From the Welfare System to the 
Treatment System 

Alcohol and drug testing that is not conducted as 
part of a diagnosis of or treatment for an alcohol 
or other drug problem is not covered by Federal 
confidentiality rules; information related to a test 
conducted as part of a diagnosis or treatment is 
covered. 

The Federal confidentiality law and regulations 
provide that information gathered by a “program” as 
defined in §2.11 CFR incident to diagnosis, treatment 
or referral for treatment, is covered. Therefore, if a 
we I fare agency is a program as defined in §2.11 and 
it conducts a urine test, blood alcohol count, or other 
test for purposes other than a diagnosis or treatment 
regimen, any information related to that test is not 
covered by the Federal confidentiality regulations. In 
that situation, the welfare agency could communicate 
information about the test results without needing to 
obtain consent or any other authorization under the 
Federal confidentiality regulations. 

The Federal confidentiality law and regulations 
would apply if the welfare agency were a “program” 
as defined in §2.11 CFR and the test was conducted 
as part of developing a diagnosis or in the course of 
referring for treatment services. If covered, the 
welfare program must obtain the written consent of 
the patient or obtain other authorization as prescribed 
by the Federal regulations before it can make any 
disclosure of information related to 
treatment and/or a diagnosis. 

Information gathered in a “prescreen” for the 
purpose of referring an individual for a diagnosis 


is not covered by the Federal law and 
regulations. 

Increasingly, many welfare agencies are instituting a 
“screen” or “prescreen” procedure to identify welfare 
recipients who may have alcohol and other drug 
problems that could create a barrier to work. 
Individuals identified by this screening mechanism as 
possibly having an alcohol or other drug problem are 
then referred to a specialist whose job is to diagnose 
and, if the diagnosis reveals a substance abuse 
problem, refer the individual for treatment. Since the 
information gathered through the screening or 
prescreening process does not constitute a diagnosis 
and is not gathered for “the purpose of treatment or 
referral for treatment,” it is not covered by the 
Federal confidentiality rules. Thus, information 
gathered from the screen or prescreen may be 
communicated without restriction and without the 
written consent of the individual or 
any other authorization. 


Practical Tip: If a welfare agency fits the 
definition of a "program" as defined in §2.11 CFR, 
the key issue in this analysis is whether a substance 
abuse specialist determined that the individual has 
an alcohol or drug problem. If such a determination 
was made, then the information gathered and the 
report generated is confidential under the Federal 
requirements. But if no determination was actually 
made as to whether the individual had a substance 
abuse problem, and instead an attempt was made 
simply to identify individuals who should be assessed 
for a diagnosis because they might have a problem, 
then nothing has been done that is covered by the 
Federal confidentiality law and regulations. 
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3. Reporting of Attendance in—and 
Failure To Attend—Substance 
Abuse Programs to the Welfare 
System 

Substance abuse programs may report a welfare 
recipient’s attendance and or failure to attend 
treatment to the welfare system as long as a valid 
written consent signed by the patient is in effect. 

Information about a welfare recipient’s parti¬ 
cipation in substance abuse treatment can be 
disclosed to the wel fare system or any other person 
or organization as long as the patient has signed a 
written consent form authorizing the disclosure. This 
includes information that may be detrimental to the 
patient in the sense that it could lead to termination of 
welfare benefits or other sanctions, including such 
facts as the failure of the individual to comply with 
treatment or leaving the program without permission 
before completion of treatment. 

A substance abuse patient is allowed to revoke 
consent under §2.31(a)(8) CFR. If a patient does 
this, the consent is no longer valid “except to the 
extent that the program or person which is to make 
the disclosure has already acted in reliance on it.” 
That subsection of the Federal regulations states that 
“[ajcting in reliance includes the provision of 
treatment services in reliance on a valid consent to 
disclose information to a third-party payer.” 

Thus, to the extent that the welfare system is a 
“third-party payer” providing payment to the 
program for the welfare recipient’s treatment, and the 
program relied on the consent to enable it to obtain 
payment, the treatment program can (but is not 
required to) continue making disclosures to the 
wel fare system for purposes of obtaining payment for 
past services even after a patient revokes consent. 

However, a program that continues to provide 
services after a patient has revoked a consent to the 
wel fare system does so at its own financial peril. 
Since the consent was already revoked when it 
provided these services the program is not relying on 
the consent and thus cannot make a disclosure to the 
wel fare system for the puipose of obtaining payment. 


Practical Tip: A consent form is only in place 
until the date, event, or condition on which it expires 
(or the patient/client revokes consent), so it is a 
good idea to make sure that the expiration set forth 
on the consent form is sufficiently far in the future 
to ensure that the welfare system can receive 
appropriate information as needed. For example, if 
the consent expires when the patient/client leaves 
treatment, a treatment program would be unable to 
report to the welfare system that a patient/client 
left before completion of treatment since the 
consent would have expired the moment he or she 
left the program. It would be more advisable to 
have the consent contain an end date that is 
flexible, reasonable, and fits relevant circumstances 
such as, "30 or 60 days after treatment ends" or 
"when the patient/client is no longer eligible for 
welfare benefits." 
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4. Patient/Client Revocation of 
Consent 

Some welfare agencies are concerned about how to 
handle the situation if a patient/client revokes 
consent. As noted, treatment programs that relied on 
a consent for disclosure to the welfare system, 
consistent with §2.31(a)(8) CFR, are permitted to 
continue making disclosures to the welfare system as 
a third-party payer even if the client attempts to 
revoke that consent. For example, the treatment 
program has extended services in reliance on a 
consent that enables the we I fare system to reimburse 
the program for treatment services. Substance abuse 
programs and welfare agencies should be aware of 
and use this provision when appropriate. 


Practical Tip: Though revocation of patient 
consent is rare, in those situations where it does 
occur, there are ways in which substance abuse 
programs and welfare agencies can still continue 
their working relationship. While effective 
revocation of patient consent precludes a 
substance abuse program from making any 
further disclosures, such as whether the patient is 
still in treatment, welfare agencies that have been 
receiving information and then abruptly run into a 
"wall of silence" can make an educated surmise 
that the client may have revoked consent. The 
welfare agency could then approach the individual, 
ask why the flow of information has stopped and, 
where appropriate, require that verification of 
treatment status be provided or eligibility for 
benefits will end. 


5. Reporting a Substance Abuse 
Patient’s Relapse to the Welfare 
System 

Unfortunately, patients in substance abuse treatment 
sometimes have relapses. For most patients who 
have relapses, treatment will continue or resume. 

Substance abuse treatment programs may report 
information about a patient’s treatment, including any 
relapse, to welfare officials if that information is 
covered by a valid written consent form signed by 
the patient. The same issues involving 
communication of treatment information and 
revocation of consent discussed previously would 
similarly apply to infoimation about a patient’s 
relapses. 


Practical Tip: Relapse information is subject to 
the same confidentiality protections as other 
treatment information. For many welfare 
agencies, the key information needed is whether 
the welfare recipient is proceeding satisfactorily in 
treatment—and satisfactory progress can include 
relapse as long as the patient remains in or 
resumes treatment—rather than whether a 
patient has relapsed. 
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6. Combined Case Planning Between 
Substance Abuse Staff and Welfare 
Caseworkers 

The success of a client’s transition to work will 
involve collaborative planning between substance 
abuse counselors and welfare caseworkers. Most of 
the discussion between substance abuse staff and 
we I fare caseworkers necessary for joint case planning 
will be permissible via a properly authorized consent 
form. It is often useful to tell a client that his case 
and progress will be discussed at periodic meetings 
(or conference calls, etc.) between substance abuse 
treatment and welfare staff. 

It is useful to explain to the client who specifically 
will participate in such discussions. It is also a good 
idea to explain that, unless authorized by the client’s 
consent form, information from such a 
discussion cannot be further disclosed. 


Practical Tip: To avoid repeated paperwork and 
confusion, it is useful to have the client complete a 
multiparty consent form that lists all the potential 
people who would be involved in case planning 
meetings. Multiparty consent forms such as the 
one shown in Appendix B (Sample Form #2) can be 
designed to fit any case planning meeting. A 
Qualified Service Organization agreement (QSOA) 
between a substance abuse treatment program and 
a service organization may also be used to conduct 
combined case planning. QSOAs are described in 
the section that follows. 


7. Qualified Service Organization 
Agreements (QSOAs) Between 


Treatment and Welfare Systems 




Substance abuse treatment programs may disclose 
information to a “Qualified Service Organization” 
without the patient’s consent (§2.12(c)(4) CFR). A 
service organization is an organization that provides 
services to the substance abuse program. An 
agreement between a treatment program and a 
Qualified Service Organization is a “Qualified Service 
Organization agreement,” or QSOA. For an 
illustration of such an agreement, see Appendix B 
(Sample Form #4). 

A QSOA permits patient-identified communication 
between the substance abuse treatment program and 
the service organization without individual client 
consent as long as the disclosure is for the purpose of 
enabling the service organization to provide a service 
to the treatment program and so long as the 
information is only disclosed back to the treatment 
program. In entering the QSOA, the service 
organization agrees to be bound by the provisions of 
42 CFR Part 2 and to resist in court any effort to 
obtain access to information which would not be 
permitted by Federal confidentiality regulations. 


Practical Tip: Although the case planning 
discussions could be conducted using consent 
forms, they would also be permissible using a 
QSOA as long as the information is not redisclosed 
beyond the welfare agency and the treatment 
program, unless further authorization were to be 
obtained. The rationale for a QSOA in this 
circumstance is that the service provided to the 
program is the benefit of having coordinated 
planning with welfare staff. The QSOA requires the 
signatures of the director of the substance abuse 
treatment program and the head of the welfare 
agency. However, reimbursement by the welfare 
system for substance abuse treatment is not a 
"service" being provided to the treatment 
organization. It is payment for a service being 
rendered by the treatment program. Thus, in 
order to make disclosures to the welfare agency for 
the purpose of recovering reimbursement for 
treatment, a program needs to obtain the client's 
written consent as discussed above. 
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IV. Essential 
Considerations 

1. Relationship with State Law 

In using this guidance, the reader should be aware 
that, apart from the Federal confidentiality law, 
States may have laws and regulations that govern the 
confidentiality of patient records for individuals who 
are receiving substance abuse treatment services. In 
instances in which a State’s confidentiality law is 
more restrictive that the Federal law, a program must 
follow the stricter State law. In instances where a 
State’s confidentiality law is less protective of 
confidentiality than the Federal law, however, the 
Federal law controls. Only rarely is there an 
irreconcilable conflict between Federal and State 
law. (See §2.20 CFR in Appendix A for a discussion 
of the relationship of Federal and State 
confidentiality laws.) 


2. Assistance of Legal Counsel 

Because the primary responsibility for compliance 
with the Federal confidentiality law and regulations 
lies with the program and its staff, it would be 
advisable for these guidelines to be thoroughly 
discussed with the program’s legal counsel. 
Likewise, readers are advised to seek the advice of 
legal counsel when designing letters and forms based 
on the samples provided here or when questions 
arise concerning any of the issues discussed in this 
guidance. 
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Appendix A—The Federal Confidentiality Law 
and Regulations 
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Appendix A—The Federal Confidentiality Law 
and Regulations 
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SUBCHAPTER A—GENERAL PROVISIONS 


PART 1 [RESERVED] 

PART 2—CONFIDENTIALITY OF 
ALCOHOL AND DRUG ABUSE 
PATIENT RECORDS 

Subpart A—Introduction 

Sec. 

2.2 Statutory authority for confidentiality of 

alcohol abuse patient records. 

2.3 Purpose and effect. 

2.4 Criminal penalty for violation. 

2.5 Reports of violations. 

Subpart B—General Provisions 

2.11 Definitions. 

2.12 Applicability. 

2.13 Confidentiality restrictions. 

2.14 Minor patients. 

2.15 Incompetent and deceased patients. 

2.16 Security for written records. 

2.17 Undercover agents and informants. 

2.18 Restrictions on the use of identification 
cards. 

2.19 Disposition of records by discontinued pro¬ 
grams. 

2.20 Relationship to State laws. 

2.21 Relationship to Federal statutes protecting 
research subjects against compulsory dis¬ 
closure of their identity. 

2.22 Notice to patients of Federal confidentiality 
requirements. 

2.23 Patient access and restriction on use. 
Subpart C—Disclosures With Patient’s Consent 

2.31 Form of written consent. 

2.32 Prohibition on redisclosure. 

2.33 Disclosures permitted with written consent. 

2.34 Disclosures to prevent multiple enrollments in 
detoxification and maintenance treatment 
programs. 


2.35 Disclosures to elements of the criminal justice 
system which have referred patients. 

Subpart D—Disclosures Without Patient 
Consent 

2.51 Medical emergencies. 

2.52 Research activities. 

2.53 Audit and evaluation activities. 

Subpart E—Court Orders Authorizing 
Disclosures and Use 

2.61 Legal effect of order. 

2.62 Order not applicable to records disclosed 
without consent to researchers, auditors 
and evaluators. 

2.63 Confidential communications. 

2.64 Procedures and criteria for orders 

authorizing disclosures for noncriminal 
purposes. 

2.65 Procedures and criteria for orders 

authorizing disclosure and use of records to 
criminally investigate or prosecute patients. 

2.66 Procedures and criteria for orders 

authorizing disclosure and use of records to 
investigate or prosecute a program or the 
person holding the records. 

2.67 Orders authorizing the use of undercover 
agents and informants to criminally 
investigate employees or agents of a 
program. 

AUTHORITY: Sec. 408 of Pub. L. 92-255, 86 
Stat. 79, as amended by sec. 303 (a), (b) of Pub L. 

93- 282, 83 Stat. 137, 138; sec. 4(c)(5)(A) of Pub. L. 

94- 237,90 Stat. 244; sec. 111(c)(3) of Pub. L. 94-581, 
90 Stat. 2852; sec. 509 of Pub. L. 96-88, 93 Stat. 695; 
sec. 973(d) of Pub. L. 97- 35, 95 Stat. 598; and 
transferred to sec. 527 of the Public Health Service Act 
by sec. 2(b)(16)(B) of Pub. L. 98-24, 97 Stat. 182 and 
as amended by sec. 106 of Pub. L. 99-401, 100 Stat. 
907 (42 U.S.C. 290ee-3) and sec. 333 of Pub. L. 
91-616, 84 Stat. 1853, as amended by sec. 122(a) of 
Pub. L. 93-282,88 Stat. 131; and sec. 111(c)(4) of Pub. 
L. 94-581, 90 Stat. 2852 and transferred to sec. 523 of 
the Public Health Service Act by sec. 2(b)(13) of Pub. L. 
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98-24,97 Stat. 181 and as amended by sec. 106ofPub. 
L. 99-401, 100 Stat. 907 (42 U.S.C. 290dd-3), as 
amendedby sec. 131ofPub.L. 102-321,106Stat.368, 
(42 U.S.C. 290dd-2). 

SOURCE: 52 FR 21809, June 9, 1987, unless 
otherwise noted. 

Subpart A—Introduction 

§2.1 Statutory authority for confidentiality of 
drug abuse patient records. 

The restrictions of these regulations upon 
the disclosure and use of drug abuse patient 
records were initially authorized by section 408 
of the Drug Abuse Prevention, Treatment, and 
Rehabilitation Act (21 U.S.C. 1175). That 
section as amended was transferred by Pub. L. 
98-24 to section 527 of the Public Health 
Service Act which is codified at 42 CFR Ch. I 
(10-1-97 Edition § 2.2 at 42 U.S.C. 290ee-3. The 
amended statutory authority is set forth below: 

§ 290ee-3. CONFIDENTIALITY OF PATIENT 
RECORDS. 

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or 
treatment of any patient which are maintained in 
connection with the performance of any drug abuse 
prevention function conducted, regulated, or directly or 
indirectly assisted by any department or agency of the 
United States shall, except as provided in subsection (e) 
of this section, be confidential and be disclosed only for 
the purposes and under the circumstances 
expressly authorized under subsection (b) of this 
section. 

(b) Purposes and circumstances of disclosure 
affecting consenting patient and patient regardless 
of consent 

(1) The content of any record referred to in 
subsection (a) of this section may be disclosed in 
accordance with the prior written consent of the 
patient with respect to whom such record is 
maintained, but only to such extent, under such 
circumstances, and for such purposes as may be 
allowed under regulations prescribed pursuant to 
subsection (g) of this section. 

(2) Whether or not the patient, with respect to 
whom any given record referred to in subsection (a) of 
this section is maintained, gives his written consent. 


the content of such record may be disclosed as 
follows: 

( A) To medical personnel to the extent necessary 
to meet a bona fide medical emergency. 

(B) To qualified personnel for the purpose of 
conducting scientific research, management audits, 
financial audits, or program evaluation, but such 
personnel may not identify, directly or indirectly, any 
individual patient in any report of such research, audit, 
or evaluation, or otherwise disclose patient identities 
in any manner. 

(C) If authorized by an appropriate order of a court of 
competent jurisdiction granted after application 
showing good cause therefor. In assessing good cause 
the court shall weigh the public interest and the need 
for disclosure against the injury to the patient, to the 
physician patient relationship, and to the treatment 
services. Upon the granting of such order, the court, in 
determining the extent to which any disclosure of all 
or any part of any record is necessary, shall impose 
appropriate safeguards against unauthorized 
disclosure. 

(c) Prohibition against use of record in making 

criminal charges or investigation of patient 
Except as authorized by a court order granted under 
subsection (b)(2)(C) of this section, no record referred 
to in subsection (a) of this section may be used to 
initiate or substantiate any criminal charges against a 
patient or to 

conduct any investigation of a patient. 

(d) Continuing prohibition against disclosure 
irrespective of status as patient 

The prohibitions of this section continue to apply to 
records concerning any individual who has been a 
patient, irrespective of whether or when he ceases to be 
a patient. 

(e) Armed Forces and Veterans’ Administration; 
interchange of records; report of suspected child 
abuse and neglect to State or local authorities 

The prohibitions of this section do not apply to any 
interchange of records— 

(1) within the Armed Forces or within those components 
of the Veterans" Administration furnishing health care to 
veterans, or 

(2) between such components and the Armed Forces. 
The prohibitions of this section do not apply to the 
reporting under State law of incidents of suspected child 
abuse and neglect to the appropriate State or local 
authorities. 

(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section or 
any regulation issued pursuant to this section shall be 



fined not more than $500 in the case of a first offense, 
and not more than $5,000 in the case of each subsequent 
offense. 

(g) Regulations; interagency consultations; 
definitions, safeguards, and procedures, including 
procedures and criteria for issuance and scope of 
orders 

Except as provided in subsection (h) of this section, the 
Secretary, after consultation with the Administrator of 
Veterans’ Affairs and the heads of other Federal 
departments and agencies substantially affected thereby, 
shall prescribe regulations to carry out the purposes of 
this section. These regulations may contain such 
definitions, and may provide for such safeguards and 
procedures, including procedures and criteria for the 
issuance and scope of orders under subsection (b)(2)(C) 
of this section, as in the judgment of the Secretary are 
necessary or proper to effectuate the purposes of this 
section, to prevent circumvention or evasion thereof, or 
to facilitate compliance therewith. 

(Subsection (h) was superseded by section 111(c)(3) of 
Pub. L. 94-581. The responsibility of the Administrator 
of Veterans’ Affairs to write regulations to provide for 
confidentiality of drug abuse patient records under Title 
38 was moved from 21 U.S.C. 1175 to 38 U.S.C. 4134.) 

§ 2.2 Statutory authority for confidentiality of 
alcohol abuse patient records. 

The restrictions of these regulations upon the 
disclosure and use of alcohol abuse patient records 
were initially authorized by section 333 of the 
Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment, and Rehabilitation Act of 
1970 (42 U.S.C. 4582). The section as amended was 
transferred by Pub. L. 98-24 to section 523 of the 
Public Health Service Act which is codified at 42 
U.S.C. 290dd-3. The amended statutory authority is 
set forth below: 

§ 290dd-3. CONFIDENTIALITY OF PATIENT 
RECORDS 

(a) Disclosure authorization 
Records of the identity, diagnosis, prognosis, or 
treatment of any patient which are maintained in 
connection with the performance of any program or 
activity relating to alcoholism or alcohol abuse 
education, training, treatment, rehabilitation, or 
research, which is conducted, regulated, or directly or 
indirectly assisted by any department or agency of the 


United States shall, except as provided in subsection 
(e) of this section, be confidential and be disclosed 
only for the purposes and under the circumstances 
expressly authorized under subsection (b) of this 
section. 

(b) Purposes and circumstances of disclosure 
affecting consenting patient and patient regardless 
of consent 

(1) The content of any record referred to in subsection 
(a) of this section may be disclosed in accordance 
with the prior written consent of the patient with 
respect to whom such record is maintained, but only to 
such extent, under such circumstances, and for such 
purposes as may be allowed under regulations 
prescribed pursuant to subsection (g) of this section. 

(2) Whether or not the patient, with respect to whom 
any given record referred to in subsection (a) of this 
section is maintained, gives his written consent, the 
content of such record may be disclosed as follows: 

(A) To medical personnel to the extent necessary to 
meet a bona fide medical emergency. 

(B) To qualified personnel for the purpose of 
conducting scientific research, management audits, 
financial audits, or program evaluation, but such 
personnel may not identify, directly or indirectly, any 
individual patient in any report of such research, audit, 
or evaluation, or otherwise disclose patient identities 
in any manner. 

(C) If authorized by an appropriate order of a court of 
competent jurisdiction granted after application 
showing good cause therefor. In assessing good cause 
the court shall weigh the public interest and the need 
for disclosure against the injury to the patient, to the 
physician patient relationship, and to the treatment 
services. Upon the granting of such order, the court, in 
determining the extent to which any disclosure of all 
or any part of any record is necessary, shall impose 
appropriate safeguards against unauthorized 
disclosure. 

(c) Prohibition against use of record in making 
criminal charges or investigation of patient 
Except as authorized by a court order granted under 
subsection (b)(2)(C) of this section, no record 
referred to in subsection (a) of this section may be 
used to initiate or substantiate any criminal charges 
against a patient or to conduct any investigation of a 
patient. 

(d) Continuing prohibition against disclosure 
irrespective of status as patient 
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The prohibitions of this section continue to apply to 
records concerning any individual who has been a 
patient, irrespective of whether or when he ceases to 
be a patient. 

(e) Armed Forces and Veterans ’ Administration; 
interchange of record of suspected child abuse and 
neglect to State or local authorities 

The prohibitions of this section do not apply to any 
interchange of records— 

(1) within the Armed Forces or within those 
components of the Veterans" Administration 
furnishing health care to veterans, or 

(2) between such components and the Armed Forces. 
The prohibitions of this section do not apply to the 
reporting under State law of incidents of suspected 
child abuse and neglect to the appropriate State or 
local authorities. 

(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section 
or any regulation issued pursuant to this section shall 
be fined not more than $500 in the case of a first 
offense, and not more than $5,000 in the case of each 
subsequent offense. 

(g) Regulations of Secretary; definitions, 
safeguards, and procedures, including procedures 
and criteria for issuance and scope of orders 
Except as provided in subsection (h) of this section, 
the Secretary shall prescribe regulations to carry out 
the purposes of this section. These regulations may 
contain such definitions, and may provide for such 
safeguards and procedures, including procedures and 
criteria for the issuance and scope of orders under 
subsection(b)(2)(C) of this section, as in the judgment 
of the Secretary are necessary or proper to effectuate 
the purposes of this section, to prevent circumvention 
or evasion thereof, or to facilitate compliance 
therewith. 

(Subsection (h) was superseded by section 111(c)(4) 
of Pub. L. 94-581. The responsibility of the 
Administrator of Veterans’ Affairs to write 
regulations to provide for confidentiality of alcohol 
abuse patient records under Title 38 was moved from 
42 U.S.C. 4582 to 38 U.S.C. 4134.) 

§ 2.3 Purpose and effect. 

(a) Purpose. Under the statutory provisions quoted in 
§§ 2.1 and 2.2, these regulations impose restrictions 
upon the disclosure and use of alcohol and drug abuse 


patient records which are maintained in connection 
with the performance of any federally assisted alcohol 
and drug abuse program. The regulations specify: 

(1) Definitions, applicability, and general 
restrictions in subpart B (definitions applicable to § 
2.34 only appear in that section); 

(2) Disclosures which may be made with written 
patient consent and the form of the written consent 
in subpart C; 

(3) Disclosures which may be made without written 
patient consent or an authorizing court order in 
subpart D; and 

(4) Disclosures and uses of patient records which 
may be made with an authorizing court order and 
the procedures and criteria for the entry and scope 
of those orders in subpart E. 

(b) Effect. (1) These regulations prohibit the 
disclosure and use of patient records unless certain 
circumstances exist. If any circumstances exists under 
which disclosure is permitted, that circumstance acts 
to remove the prohibition on disclosure but it does not 
compel disclosure. Thus, the regulations do not 
require disclosure under any circumstances. 

(2) These regulations are not intended to direct the 
manner in which substantive functions such as 
research, treatment, and evaluation are carried out. 
They are intended to insure that an alcohol or drug 
abuse patient in a federally assisted alcohol or drug 
abuse program is not made more vulnerable by 
reason of the availability of his or her patient record 
than an individual who has an alcohol or drug 
problem and who does not seek treatment. 

(3) Because there is a criminal penalty (a fine—see 
42 U.S.C. 290ee-3(f), 42 U.S.C. 290dd-3(f) and 
42 CFR 2.4) for violating the regulations, they are 
to be construed strictly in favor of the potential 
violator in the same manner as a criminal statute 
(see M. Kraus & Brothers v. United States, 327 
U.S. 614, 621-22, 66 S. Ct. 705, 707-08 (1946)). 

§ 2.4 Criminal penalty for violation. 

Under 42 U.S.C. 290ee-3(f) and 42 U.S.C. 
290dd-3(f), any person who violates any provision 
of those statutes or these regulations shall be fined 
not more than $500 in the case of a first offense, 
and not more than $5,000 in the case of each 
subsequent offense. 

§ 2.5 Reports of violations. 
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(a) The report of any violation of these regulations 
may be directed to the United States Attorney for 
the judicial district in which the violation occurs. 

(b) The report of any violation of these regulations 
by a methadone program may be directed to the 
Regional Offices of the Food and Drug 
Administration. 


Subpart B—General Provisions 

§ 2.11 Definitions. 

For purposes of these regulations: 

Alcohol abuse means the use of an alcoholic 
beverage which impairs the physical, mental, 
emotional, or social well-being of the user. 

Drug abuse means the use of a psychoactive 
substance for other than medicinal puiposes which 
impairs the physical, mental, emotional, or social 
well-being of the user. 

Diagnosis means any reference to an individual’s 
alcohol or drug abuse or to a condition which is 
identified as having been caused by that abuse 
which is made for the purpose of treatment or 
referral for treatment. 

Disclose or disclosure means a communication of 
patient identifying information, the affirmative 
verification of another person’s communication of 
patient identifying infoimation, or the 
communication of any information from the record 
of a patient who has been identified. 

Informant means an individual: 

(a) Who is a patient or employee of a program or 
who becomes a patient or employee of a program 
at the request of a law enforcement agency or 
official: and 

(b) Who at the request of a law enforcement 
agency or official observes one or more patients or 
employees of the program for the purpose of 
reporting the infoimation obtained to the law 
enforcement agency or official. 

Patient means any individual who has applied for 
or been given diagnosis or treatment for alcohol or 
drug abuse at a federally assisted program and 
includes any individual who, after arrest on a 
criminal charge, is identified as an alcohol or drug 
abuser in order to determine that individual’s 
eligibility to participate in a program. 


Patient identifying information means the name, 
address, social security number, fingerprints, 
photograph, or similar information by which the 
identity of a patient can be determined with 
reasonable accuracy and speed either directly or by 
reference to other publicly available infoimation. 
The term does not include a number assigned to a 
patient by a program, if that number does not 
consist of, or contain numbers (such as a social 
security, or driver’s license number) which could 
be used to identify a patient with reasonable 
accuracy and speed from sources external to the 
program. 

Person means an individual, partnership, 
corporation, Federal, State or local government 
agency, or any other legal entity. 

Program means: 

(a) An individual or entity (other than a general 
medical care facility) who holds itself out as 
providing, and provides, alcohol or drug abuse 
diagnosis, treatment or referral for treatment; or 

(b) An identified unit within a general medical 
facility which holds itself out as providing, and 
provides, alcohol or drug abuse diagnosis, 
treatment or referral for treatment; or 

(c) Medical personnel or other staff in a general 
medical care facility whose primary function is the 
provision of alcohol or drug abuse diagnosis, 
treatment or referral for treatment and who are 
identified as such providers. (See § 2.12(e)(1) for 
examples.) 

Program director means: 

(a) In the case of a program which is an individual, 
that individual: 

(b) In the case of a program which is an 
organization, the individual designated as director, 
managing director, or otherwise vested with 
authority to act as chief executive of the 
organization. 
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Qualified Service Organization means a 
person which: 

(a) Provides services to a program, such as data 
processing, bill collecting, dosage preparation, 
laboratory analyses, or legal, medical, accounting, 
or other professional services, or services to 
prevent or treat child abuse or neglect, including 
training on nutrition and child care and individual 
and group therapy, and 

(b) Has entered into a written agreement with a 
program under which that person: 

(1) Acknowledges that in receiving, storing, 
processing or otherwise dealing with any patient 
records from the programs, it is fully bound by 
these regulations; and 

(2) If necessary, will resist in judicial proceedings 
any efforts to obtain access to patient records 
except as permitted by these regulations. 

Records means any information, whether recorded 
or not, relating to a patient received or acquired by 
a federally assisted alcohol or drug program. 

Third party payer means a person who pays, or 
agrees to pay, for diagnosis or treatment furnished 
to a patient on the basis of a contractual 
relationship with the patient or a member of his 
family or on the basis of the patient’s eligibility for 
Federal, State, or local governmental benefits. 
Treatment means the management and care of a 
patient suffering from alcohol or drug abuse, a 
condition which is identified as having been caused 
by that abuse, or both, in order to reduce or 
eliminate the adverse effects upon the patient. 

Undercover agent means an officer of any 
Federal, State, or local law enforcement agency who 
enrolls in or becomes an employee of a program for 
the purpose of investigating a suspected violation of 
law or who pursues that purpose after enrolling or 
becoming employed for other purposes. 

[52 FR 21809, June 9, 1987, as amended by 60 FR 
22297, May 5, 1995] 


§ 2.12 Applicability. 

(a) General —(1) Restrictions on disclosure. The 
restrictions on disclosure in these regulations apply 
to any information, whether or not recorded, which: 

(1) Would identify a patient as an alcohol or drug 
abuser either directly, by reference to other publicly 
available information, or through verification of 
such an identification by another person; and 

(ii) Is drug abuse information obtained by a 
federally assisted drug abuse program after March 
20, 1972, or is alcohol abuse information obtained 
by a federally assisted alcohol abuse program after 
May 13, 1974 (or if obtained before the pertinent 
date, is maintained by a federally assisted alcohol or 
drug abuse program after that date as part of an 
ongoing treatment episode which extends past that 
date) for the purpose of treating alcohol or drug 
abuse, making a diagnosis for that treatment, or 
making a referral for that treatment. 

(2) Restriction on use. The restriction on use of 
information to initiate or substantiate any criminal 
charges against a patient or to conduct any criminal 
investigation of a patient (42 U.S.C. 290ee-3(c), 42 
U.S.C. 290dd-3(c)) applies to any information, 
whether or not recorded which is drug abuse 
information obtained by a federally assisted drug 
abuse program after March 20, 1972, or is alcohol 
abuse information obtained by a federally assisted 
alcohol abuse program after May 13, 1974 (or if 
obtained before the pertinent date, is maintained by 
a federally assisted alcohol or drug abuse program 
after that date as part of an ongoing treatment 
episode which extends past that date), for the 
purpose of treating alcohol or drug abuse, making a 
diagnosis for the treatment, or making a referral for 
the treatment. 

(b) Federal assistance. An alcohol abuse or drug 
abuse program is considered to be federally assisted 
if: 

(1) It is conducted in whole or in part, whether 
directly or by contract or otherwise by any 
department or agency of the United States (but see 
paragraphs (c)(1) and (c)(2) of this section relating 
to the Veterans’ Administration and the Armed 
Forces); 
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(2) It is being carried out under a license, 
certification, registration, or other authorization 
granted by any department or agency of the United 
States including but not limited to: 

(i) Certification of provider status under the 
Medicare program; 

(ii) Authorization to conduct methadone 
maintenance treatment (see 21 CFR 291.505); or 

(iii) Registration to dispense a substance under the 
Controlled Substances Act to the extent the 
controlled substance is used in the treatment of 
alcohol or drug abuse; 

(3) It is supported by funds provided by any 
department or agency of the United States by 
being: 

(1) A recipient of Federal financial assistance in any 
form, including financial assistance which does not 
directly pay for the alcohol or drug abuse diagnosis, 
treatment, or referral activities; or 

(ii) Conducted by a State or local government unit 
which, through general or special revenue sharing 
or other forms of assistance, receives Federal funds 
which could be (but are not necessarily) spent for 
the alcohol or drug abuse program; or 

(4) It is assisted by the Internal Revenue Service of 
the Department of the Treasury through the 
allowance of income tax deductions for 
contributions to the program or through the 
granting of tax exempt status to the program. 

(c) Exceptions —(1) Veterans’ Administration. 
These regulations do not apply to information on 
alcohol and drug abuse patients maintained in 
connection with the Veterans’ Administration 
provisions of hospital care, nursing home care, 
domiciliary care, and medical services under title 
38, United States Code. Those records are 
governed by 38 U.S.C. 4132 and regulations issued 
under that authority by the Administrator of 
Veterans’ Affairs. 

(2) Armed Forces. These regulations apply to any 
information described in paragraph (a) of this 
section which was obtained by any component of 
the Armed Forces during a period when the patient 
was subject to the Uniform Code of Military 
Justice except: 

(i) Any interchange of that information within the 
Armed Forces; and 

(ii) Any interchange of that information between 
the Armed Forces and those components of the 


Veterans Administration furnishing health care to 
veterans. 

(3) Communication within a program or between 
a program and an entity having direct 
administrative control over that program. The 
restrictions on disclosure in these regulations do not 
apply to communications of information between 
or among personnel having a need for the 
information in connection with their duties that 
arise out of the provision of diagnosis, treatment, or 
referral for treatment of alcohol or drug abuse if the 
communications are 

(i) Within a program or 

(ii) Between a program and an entity that has direct 
administrative control over the program. 

(4) Qualified Service Organizations. The 
restrictions on disclosure in these regulations do not 
apply to communications between a program and a 
qualified service organization of information needed 
by the organization to provide services to the 
program. 

(5) Crimes on program premises or against 
program personnel. The restrictions on disclosure 
and use in these regulations do not apply to 
communications from program personnel to law 
enforcement officers which— 

(i) Arc directly related to a patient’s commission of 
a crime on the premises of the program or against 
program personnel or to a threat to commit such a 
crime; and 

(ii) Are limited to the circumstances of the incident, 
including the patient status of the individual 
committing or threatening to commit the crime, that 
individual’s name and address, and that individual’s 
last known whereabouts. 

(6) Reports of suspected child abuse and neglect. 
The restrictions on disclosure and use in these 
regulations do not apply to the reporting under 
State law of incidents of suspected child abuse and 
neglect to the appropriate State or local authorities. 
However, the restrictions continue to apply to the 
original alcohol or drug abuse patient records 
maintained by the program including their 
disclosure and use for civil or criminal proceedings 
which may arise out of the report of suspected 
child abuse and neglect. 
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(d) Applicability to recipients of information —(1) 
Restriction on use of information. The restriction 
on the use of any information subject to these 
regulations to initiate or substantiate any criminal 
charges against a patient or to conduct any criminal 
investigation of a patient applies to any person who 
obtains that information from a federally assisted 
alcohol or drug abuse program, regardless of the 
status of the person obtaining the information or of 
whether the information was obtained in 
accordance with these regulations. This restriction 
on use bars, among other things, the introduction 
of that information as evidence in a criminal 
proceeding and any other use of the information to 
investigate or prosecute a patient with respect to a 
suspected crime. Information obtained by 
undercover agents or informants (see § 2.17) or 
through patient access (see § 2.23) is subject to the 
restriction on use. 

(2) Restrictions on disclosures—Third party 
payers, administrative entities, and others. The 
restrictions on disclosure in these regulations apply 
to: 

(i) Third party payers with regard to records 
disclosed to them by federally assisted alcohol or 
drug abuse programs; 

(ii) Entities having direct administrative control 
over programs with regard to information 
communicated to them by the program under § 
2.12(c)(3); and 

(iii) Persons who receive patient records directly 
from a federally assisted alcohol or drug abuse 
program and who are notified of the restrictions on 
redisclosure of the records in accordance with § 
2.32 of these regulations. 

(e) Explanation of applicability —(1) Coverage. 
These regulations cover any information (including 
information on referral and intake) about alcohol 
and drug abuse patients obtained by a program (as 
the terms ‘ ‘patient’ ’ and ‘ ‘program’ ’ are defined in 
§ 2.11) if the program is federally assisted in any 
manner described in § 2.12(b). Coverage includes, 
but is not limited to, those treatment or 
rehabilitation programs, employee assistance 
programs, programs within general hospitals, based 
programs, and private practitioners who hold 
themselves out as providing, and provide alcohol or 
drug abuse diagnosis, treatment, or referral for 
treatment. However, these regulations would not 
apply, for example, to emergency room personnel 


who refer a patient to the intensive care unit for an 
apparent overdose, unless the primary function of 
such personnel is the provision of alcohol or drug 
abuse diagnosis, treatment or referral and they are 
identified as providing such services or the 
emergency room has promoted itself to the 
community as a provider of such services. 

(2) Federal assistance to program required. If a 
patient’s alcohol or drug abuse diagnosis, 
treatment, or referral for treatment is not provided 
by a program which is federally conducted, 
regulated or supported in a manner which 
constitutes Federal assistance under § 2.12(b), that 
patient’s record is not covered by these regulations. 
Thus, it is possible for an individual patient to 
benefit from Federal support and not be covered by 
the confidentiality regulations because the program 
in which the patient is enrolled is not federally 
assisted as defined in § 2.12(b). For example, if a 
Federal court placed an individual in a private for- 
profit program and made a payment to the program 
on behalf of that individual, that patient’s record 
would not be covered by these regulations unless 
the program itself received Federal assistance as 
defined by § 2.12(b). 

(3) Information to which restrictions are 
applicable. Whether a restriction is on use or 
disclosure affects the type of information which 
may be available. The restrictions on disclosure 
apply to any infoimation which would identify a 
patient as an alcohol or drug abuser. The restriction 
on use of infoimation to bring criminal charges 
against a patient for a crime applies to any 
information obtained by the program for the 
puipose of diagnosis, treatment, or referral for 
treatment of alcohol or drug abuse. (Note that 
restrictions on use and disclosure apply to 
recipients of information under § 2.12(d).) 

(4) How type of diagnosis affects coverage. These 
regulations cover any record of a diagnosis 
identifying a patient as an alcohol or drug abuser 
which is prepared in connection with the treatment 
or referral for treatment of alcohol or drug abuse. A 
diagnosis prepared for the puipose of treatment or 
referral for treatment but which is not so used is 
covered by these regulations. The following are not 
covered by these regulations: 

(i) Diagnosis which is made solely for the purpose 
of providing evidence for use by law enforcement 
authorities; or 
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(ii) A diagnosis of drug overdose or alcohol 
intoxication which clearly shows that the individual 
involved is not an alcohol or drug abuser (e.g., 
involuntary ingestion of alcohol or drugs or reaction 
to a prescribed dosage of one or more drugs). 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987, as amended at 60 FR 22297, May 5, 1995] 

§ 2.13 Confidentiality restrictions. 

(a) General. The patient records to which these 
regulations apply may be disclosed or used only as 
permitted by these regulations and may not 
otherwise be disclosed or used in any civil, 
criminal, administrative, or legislative proceedings 
conducted by any Federal, State, or local authority. 
Any disclosure made under these regulations must 
be limited to that information which is necessary to 
carry out the puipose of the disclosure. 

(b) Unconditional compliance required. The 
restrictions on disclosure and use in these 
regulations apply whether the holder of the 
information believes that the person seeking the 
information already has it, has other means of 
obtaining it, is a law enforcement or other official, 
has obtained a subpoena, or asserts any other 
justification for a disclosure or use which is not 
permitted by these regulations. 

(c) Acknowledging the presence of patients: 
Responding to requests. (1) The presence of an 
identified patient in a facility or component of a 
facility which is publicly identified as a place where 
only alcohol or drug abuse diagnosis, treatment, or 
referral is provided may be acknowledged only if 
the patient’s written consent is obtained in 
accordance with subpart C of these regulations or if 
an authorizing court order is entered in accordance 
with subpart E of these regulations. The regulations 
permit acknowledgment of the presence of an 
identified patient in a facility or pail of a facility if 
the facility is not publicly identified as only an 
alcohol or drug abuse diagnosis, treatment or 
referral facility, and if the acknowledgment does 
not reveal that the patient is an alcohol or drug 
abuser. 

(2) Any answer to a request for a disclosure of 
patient records which is not permissible under these 
regulations must be made in a way that will not 


affirmatively reveal that an identified individual has 
been, or is being diagnosed or treated for alcohol or 
drug abuse. An inquiring party may be given a copy 
of these regulations and advised that they restrict 
the disclosure of alcohol or drug abuse patient 
records, but may not be told affirmatively that the 
regulations restrict the disclosure of the records of 
an identified patient. The regulations do not restrict 
a disclosure that an identified individual is not and 
never has been a patient. 

§ 2.14 Minor patients. 

(a) Definition of minor. As used in these 
regulations the teim “minor” means a person who 
has not attained the age of majority specified in the 
applicable State law, or if no age of majority is 
specified in the applicable State law, the age of 
eighteen years. 

(b) State law not requiring parental consent to 
treatment. If a minor patient acting alone has the 
legal capacity under the applicable State law to 
apply for and obtain alcohol or drug abuse 
treatment, any written consent for disclosure 
authorized under subpart C of these regulations 
may be given only by the minor patient. This 
restriction includes, but is not limited to, any 
disclosure of patient identifying information to the 
parent or guardian of a minor patient for the 
purpose of obtaining financial reimbursement. 

These regulations do not prohibit a program from 
refusing to provide treatment until the minor patient 
consents to the disclosure necessary to obtain 
reimbursement, but refusal to provide treatment 
may be prohibited under a State or local law 
requiring the program to furnish the service 
irrespective of ability to pay. 

(c) State law requiring parental consent to 
treatment. (1) Where State law requires consent of 
a parent, guardian, or other person for a minor to 
obtain alcohol or drug abuse treatment, any written 
consent for disclosure authorized under subpart C 
of these regulations must be given by both the 
minor and his or her parent, guardian, or other 
person authorized under State law to act in the 
minor’s behalf. 

(2) Where State law requires parental consent to 
treatment the fact of a minor’s application for 
treatment may be communicated to the minor’s 
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parent, guardian, or other person authorized under 
State law to act in the minor’s behalf only if: 

(i) The minor has given written consent to the 
disclosure in accordance with subpart C of these 
regulations or 

(ii) The minor lacks the capacity to make a rational 
choice regarding such consent as judged by the 
program director under paragraph (d) of this 
section. 

(d) Minor applicant for services lacks capacity for 
rational choice. Facts relevant to reducing a threat 
to the life or physical well being of the applicant or 
any other individual may be disclosed to the parent, 
guardian, or other person authorized under State 
law to act in the minor’s behalf if the program 
director judges that: 

(1) A minor applicant for services lacks capacity 
because of extreme youth or mental or physical 
condition to make a rational decision on whether to 
consent to a disclosure under subpart C of these 
regulations to his or her parent, guardian, or other 
person authorized under State law to act in the 
minor’s behalf, and 

(2) The applicant’s situation poses a substantial 
threat to the life or physical well being of the 
applicant or any other individual which may be 
reduced by communicating relevant facts to the 
minor’s parent, guardian, or other person 
authorized under State law to act in the minor’s 
behalf. 

§ 2.15 Incompetent and deceased patients. 

(a) Incompetent patients other than minors —(1) 
Adjudication of incompetence. In the case of a 
patient who has been adjudicated as lacking the 
capacity, for any reason other than insufficient age, 
to manage his or her own affairs, any consent 
which is required under these regulations may be 
given by the guardian or other person authorized 
under State law to act in the patient’s behalf. 

(2) No adjudication of incompetency. For any 
period for which the program director determines 
that a patient, other than a minor or one who has 
been adjudicated incompetent, suffers from a 
medical condition that prevents knowing or 
effective action on his or her own behalf, the 
program director may exercise the right of the 
patient to consent to a disclosure under subpart C 
of these regulations for the sole purpose of 


obtaining payment for services from a third party 
payer. 

(b) Deceased patients —(1) Vital statistics. These 
regulations do not restrict the disclosure of patient 
identifying information relating to the cause of 
death of a patient under laws requiring the 
collection of death or other vital statistics or 
permitting inquiry into the cause of death. 

(2) Consent by personal representative. Any other 
disclosure of information identifying a deceased 
patient as an alcohol or drug abuser is subject to 
these regulations. If a written consent to the 
disclosure is required, that consent may be given by 
an executor, administrator, or other personal 
representative appointed under applicable State 
law. If there is no such appointment the consent 
may be given by the patient’s spouse or, if none, 
by any responsible member of the patient’s family. 

§ 2.16 Security for written records. 

(a) Written records which are subject to these 
regulations must be maintained in a secure room, 
locked file cabinet, safe or other similar container 
when not in use; and 

(b) Each program shall adopt in writing procedures 
which regulate and control access to and use of 
written records which are subject to these 
regulations. 
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§ 2.17 Undercover agents and informants. 

(a) Restrictions on placement. Except as 
specifically authorized by a court order granted 
under § 2.67 of these regulations, no program may 
knowingly employ, or enroll as a patient, any 
undercover agent or informant. 

(b) Restriction on use of information. No 
information obtained by an undercover agent or 
informant, whether or not that undercover agent or 
informant is placed in a program pursuant to an 
authorizing court order, may be used to criminally 
investigate or prosecute any patient. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.18 Restrictions on the use of identification 
cards. 

N o person may require any patient to carry on his or 
her person while away from theprogram premises any 
card or other obi ect which would identify the patient as 
an alcohol or drug abuser. T his section does not prohibit 
a person from requiring patients to use or carry cards 
or other identification objects on the premises of a 
program. 

§ 2.19 Disposition of records by discontinued 
programs. 

(a) General. If a program discontinues operations 
or is taken over or acquired by another program, it 
must purge patient identifying information from its 
records or destroy the records unless— 

(1) T he patient who is thesubi ect of the records gives 
written consent (meeting thereguirements of § 2.31) to a 
transfer of therecords to theacguiring program or to 
any other program designated in the consent (the 
manner of obtaining this consent must minimize the 
likelihood of a disclosure of patient identifying 
information to a third party); or 

(2) Thereisa legal reguirement that the records be 
kept for a period specified by law which does not expire 
until after the discontinuation or acguisition of the 
program. 

(b) Procedure where retention period required by 
law. If paragraph (a)(2) of this section applies, the 
records must be: 


(1) Sealed in envelopes or other containers labeled 
as follows: “Records of [insert name of program] 
required to be maintained under [insert citation to 
statute, regulation, court order or other legal 
authority requiring that records be kept] until a date 
not later than [insert appropriate date] ’ ’; and 

(2) Held under the restrictions of these regulations 
by a responsible person who must, as soon as 
practicable after the end of the retention period 
specified on the label, destroy the records. 

§ 2.20 Relationship to State laws. 

The statutes authorizing these regulations (42 
U.S.C. 290ee-3 and 42 U.S.C. 290dd-3) do not 
preempt the field of law which they cover to the 
exclusion of all State laws in that field. If a 
disclosure permitted under these regulations is 
prohibited under State law, neither these regulations 
nor the authorizing statutes may be construed to 
authorize any violation of that State law. However, 
no State law may either authorize or compel any 
disclosure prohibited by these regulations. 

§ 2.21 Relationship to Federal statutes pro¬ 
tecting research subjects against compulsory 
disclosure of their identity. 

(a) Research privilege description. There may be 
concurrent coverage of patient identifying 
information by these regulations and by 
administrative action taken under: Section 303(a) of 
the Public Health Service Act (42 U.S.C. 242a(a) 
and the implementing regulations at 42 CFR part 
2a); or section 502(c) of the Controlled Substances 
Act (21 U.S.C. 872(c) and the implementing 
regulations at 21 CFR 1316.21). These “research 
privilege” statutes confer on the Secretary of 
Health and Human Services and on the Attorney 
General, respectively, the power to authorize 
researchers conducting certain types of research to 
withhold from all persons not connected with the 
research the names and other identifying 
information concerning individuals who are the 
subjects of the research. 

(b) Effect of concurrent coverage. These 
regulations restrict the disclosure and use of 
information about patients, while administrative 
action taken under the research privilege statutes 
and implementing regulations protects a person 
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engaged in applicable research from being 
compelled to disclose any identifying characteristics 
of the individuals who are the subjects of that 
research. The issuance under subpart E of these 
regulations of a court order authorizing a disclosure 
of information about a patient does not affect an 
exercise of authority under these research privilege 
statutes. However, the research privilege granted 
under 21 CFR 291.505(g) to treatment programs 
using methadone for maintenance treatment does 
not protect from compulsory disclosure any 
information which is permitted to be disclosed 
under those regulations. Thus, if a court order 
entered in accordance with subpart E of these 
regulations authorizes a methadone maintenance 
treatment program to disclose certain information 
about its patients, that program may not invoke the 
research privilege under 21 CFR 291.505(g) as a 
defense to a subpoena for that information. 


appropriate State or local authorities are not 
protected. 

(5) A citation to the Federal law and regulations. 

(c) Program options. The program may devise its 
own notice or may use the sample notice in 
paragraph (d) to comply with the requirement to 
provide the patient with a summary in writing of 
the Federal law and regulations. In addition, the 
program may include in the written summary 
information concerning State law and any program 
policy not inconsistent with State and Federal law 
on the subject of confidentiality of alcohol and drug 
abuse patient records. 

(d) Sample notice. 

CONFIDENTIALITY OF ALCOHOL AND DRUG 
ABUSE PATIENT RECORDS 


§ 2.22 Notice to patients of Federal 
confidentiality requirements. 

(a) Notice required. At the time of admission or as 
soon thereafter as the patient is capable of rational 
communication, each program shall: 

(1) Communicate to the patient that Federal law 
and regulations protect the confidentiality of 
alcohol and drug abuse patient records; and 

(2) Give to the patient a summary in writing of the 
Federal law and regulations. 

(b) Required elements of written summary. The 
written summary of the Federal law and regulations 
must include: 

(1) A general description of the limited 
circumstances under which a program may 
acknowledge that an individual is present at a 
facility or disclose outside the program information 
identifying a patient as an alcohol or drug abuser. 

(2) A statement that violation of the Federal law 
and regulations by a program is a crime and that 
suspected violations may be reported to appropriate 
authorities in accordance with these regulations. 

(3) A statement that information related to a 
patient’s commission of a crime on the premises of 
the program or against personnel of the program is 
not protected. 

(4) A statement that reports of suspected child 
abuse and neglect made under State law to 


The confidentiality of 
alcohol and drug abuse patient 
records maintained by this 
program is protected by Federal 
law and regulations. Generally, 
the program may not say to a 
person outside the program that 
a patient attends the program, 
or disclose any information 
identifying a patient as an 
alcohol or drug abuser Unless: 

(1) The patient consents in writing: 

(2) The disclosure is allowed by a court order; or 

(3) The disclosure is made to medical personnel 
in a medical emergency or to qualified personnel for 
research, audit, or program evaluation. Violation of the 
Federal law and regulations by a program is a crime. 
Suspected violations may be reported to appropriate 
authorities in accordance with Federal regulations. 
Federal law and regulations do not protect any 
information about a crime committed by a patient 
either at the program or against any person who works 
for the program or about any threat to commit such a 
crime. Federal laws and regulations do not protect any 
information about suspected child abuse or neglect 
from being reported under State law to appropriate 
State or local authorities. 


(See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for 
Federal laws and 42 CFR part 2 for Federal regulations.) 
(Approved by the Office of Management and Budget 
under control number 0930-0099) 
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§ 2.23 Patient access and restrictions on use. 

(a) Patient access not prohibited. These regulations do 
not prohibit a program from giving a patient access to 
his or her own records, including the opportunity to 
inspect and copy any records that the program maintains 
about the patient. The program is not required to obtain 
a patient's written consent or other authorization under 
these regulations in order to provide such access to the 
patient. 

(b) Restriction on use of information. Information 
obtained by patient access to his or her patient record is 
subject to the restriction on use of his information to 
initiate or substantiate any criminal charges against the 
patient or to conduct any criminal investigation of the 
patient as provided for under § 2.12(d)(1). 


Subpart C—Disclosures With Patient’s 
Consent 

§ 2.31 Form of written consent. 

(а) Required elements. A written consent to a disclosure 
under these regulations must include: 

(1) The specific name or general designation of the 

program or person permitted to make the 
disclosure. 

(2) The name or title of the individual or the name 
of the organization to which disclosure is to be 

made. 

(3) The name of the patient. 

(4) The purpose of the disclosure. 

(5) How much and what kind of information is to 
be disclosed. 

(б) The signature of the patient and, when required 
for a patient who is a minor, the signature of a 

person authorized to give consent under § 2.14; or, 
when required for a patient who is incompetent or 
deceased, the signature of a person authorized to 
sign under § 2.15 in lieu of the patient. 

(7) The date on which the consent is signed. 

(8) A statement that the consent is subject to 
revocation at any time except to the extent that the 
program or person which is to make the disclosure 

has already acted in reliance on it. Acting in 
reliance includes the provision of treatment services 
in reliance on a valid consent to disclose 
infoimation to a third party payer. 

(9) The date, event, or condition upon which the 


consent will expire if not revoked before. This date, 
event, or condition must insure that the consent will 
last no longer than reasonably necessary to serve 
the purpose for which it is given. 

(b) Sample consent form. The following form complies 
with paragraph (a) of this section, but other elements 
may be added. 

1.1 (name of patient) 


0 Request Q Authorize: 

2.(name or general designation of program which 
is to make the disclosure) 


3. To disclose: (kind and amount of information to 
be disclosed) 


4. To \(name or title of the person or organization 
to which disclosure is to be made) 


5. For: (purpose of the disclosure) 


6. Date: (on which this consent is signed) 


1. Signature of patient 


8. Signature of parent or guardian ( where required ) 


9. Signature of person authorized to sign in lieu of 
the patient (where required) 


10. This consent is subject to revocation at any time 
except to the extent that the program which is to make 
the disclosure has already taken action in reliance on it. 
If not previously revoked, this consent will terminate 
upon: (specific date, event, or condition) 


(c) Expired, deficient, or false consent. A disclosure 
may not be made on the basis of a consent which: 
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(1) Has expired; 

(2) On its face substantially fails to conform to 
any of the requirements set forth in paragraph (a) of 
this section; 

(3) Is known to have been revoked; or 

(4) Is known, or through a reasonable effort 
could be known, by the person holding the records to 
be materially false. 

(Approved by the Office of Management and Budget 
under control number 0930-0099) 

§ 2.32 Prohibition on redisclosure. 

Notice to accompany disclosure. Each dis¬ 
closure made with the patient’s written consent must 
be accompanied by the following written statement: 

This information has been disclosed to you from 
records protected by Federal confidentiality rules (42 
CFR part 2). The Federal rules prohibit you from making 
any further disclosure of this information unless further 
disclosure is expressly permitted by the written consent 
of the person to whom it pertains or as otherwise 
permitted by 42 CFR part 2. A general authorization for 
the release of medical or other information is NOT 
sufficient for this purpose. The Federal rules restrict any 
use of the information to criminally investigate or 
prosecute any alcohol or drag abuse patient. 

[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2, 
1987] 

§ 2.33 Disclosures permitted with written consent. 

If a patient consents to a disclosure of his or her 
records under § 2.31, a program may disclose those 
records in accordance with that consent to any 
individual or organization named in the consent, 
except that disclosures to central registries and in 
connection with criminal justice referrals must meet 
the requirements of §§ 2.34 and 2.35, respectively. 

§ 2.34 Disclosures to prevent multiple enroll¬ 
ments in detoxification and maintenance 
treatment programs. 

(a) Definitions. For purposes of this section: 

Central registry means an organization which 
obtains from two or more member programs patient 
identifying information about individuals applying for 
maintenance treatment or detoxification treatment for 


the puipose of avoiding an individual’s concurrent 
enrollment in more than one program. 

Detoxification treatment means the dispensing 
of a narcotic drug in decreasing doses to an individual 
in order to reduce or eliminate adverse physiological 
or psychological effects incident to withdrawal from 
the sustained use of a narcotic drug. 

Maintenance treatment means the 
dispensing of a narcotic drug in the treatment of 
an individual for dependence upon heroin or 
other morphine-like drugs. 

Member program means a detoxification 
treatment or maintenance treatment program 
which reports patient identifying information to 
a central registry and which is in the same State 
as that central registry or is not more than 125 
miles from any border of the State in which the 
central registry is located. 

(b) Restrictions on disclosure. A program may 
disclose patient records to a central registry or to any 
detoxification or maintenance treatment program not 
more than 200 miles away for the purpose of 
preventing the multiple enrollment of a patient only if: 

(1) The disclosure is made when: 

(i) The patient is accepted for treatment; 

(ii) The type or dosage of the drug is changed; or 

(iii) The treatment is interrupted, resumed or 
terminated. 

(2) The disclosure is limited to: 

(i) Patient identifying information; 

(ii) Type and dosage of the drug; and 

(iii) Relevant dates. 

(3) The disclosure is made with the patient's written 
consent meeting the requirements of §2.31, except 
that: 

(i) The consent must list the name and address of each 
central registry and each known detoxification or 
maintenancetreatment program to which a disclosure 
will be made; and 

(ii) The consent may authorize a disclosure to any 
detoxification or maintenance treatment program 
established within 200 miles of the program after the 
consent is given without naming any such program. 

(c) Use of information limited to prevention of 
multiple enrollments. A central registry and any 
detoxification or maintenance treatment program to 
which infoimation is disclosed to prevent multiple 
enrollments may not redisclose or use patient 
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identifying information for any purpose other than 
the prevention of multiple enrollments unless 
authorized by a court order under subpart E of these 
regulations. 

(d) Permitted disclosure by a central registry to 
prevent a multiple enrollment. When a member 
program asks a central registry if an identified patient 
is enrolled in another member program and the 
registry determines that the patient is so enrolled, the 
registry may disclose— 

(1) The name, address, and telephone number of the 
member program(s) in which the patient is already 
enrolled to the inquiring member program; and 

(2) The name, address, and telephone number of the 
inquiring member program to the member program(s) in 
which the patient is already enrolled. The member 
programs may communicate as necessary to verify that 
no error has been made and to prevent or eliminate any 
multiple enrollment. 

(e) Permitted disclosure by a detoxification or 
maintenance treatment program to prevent a 
multiple enrollment. A detoxification or maintenance 
treatment program which has received a disclosure 
under this section and has determined that the patient 
is already enrolled may communicate as necessary 
with the program making the disclosure to verify that 
no error has been made and to prevent or eliminate 
any multiple enrol lm ent. 

§ 2.35 Disclosures to elements of the criminal 
justice system which have referred patients. 

(a) A program may disclose information about a 
patient to those persons within the criminal justice 
system which have made participation in the program 
a condition of the disposition of any criminal 
proceedings against the patient or of the patient’s 
parole or other release from custody if: 

(1) The disclosure is made only to those individuals 
within the criminal justice system who have a need for 
the information in connection with their duty to 
monitor the patient's progress (e.g., a prosecuting 
attorney who is withholding charges against the 
patient, a court granting pretrial or posttrial release, 
probation or parole officers responsible for supervision 
of the patient); and (2) The patient has signed a 
written consent meeting the requirements of § 2.31 
(except paragraph (a)(8) which is inconsistent with the 
revocation provisions of paragraph (c) of this section) 
and the requirements of paragraphs (b) and (c) of this 


section. 

(b) Duration of consent. The written consent must 
state the period during which it remains in effect. 
This period must be reasonable, taking into account: 

(1) The anticipated length of the treatment; 

(2) The type of criminal proceeding involved, the 
need for the information in connection with the final 
disposition of that proceeding, and when the final 
disposition will occur; and 

(3) Such other factors as the program, the patient, 
and the person(s) who will receive the disclosure 
consider pertinent. 

(c) Revocation of consent. The written consent must 
state that it is revocable upon the passage of a 
specified amount of time or the occurrence of a 
specified, ascertainable event. The time or 
occurrence upon which consent becomes revocable 
may be no later than the final disposition of the 
conditional release or other action in connection with 
which consent was given. 

(d) Restrictions on redisclosure and use. A person 
who receives patient information under this section 
may redisclose and use it only to carry out that 
person’s official duties with regard to the patient’s 
conditional release or other action in connection with 
which the consent was given. 

Subpart D—Disclosures Without Patient 
Consent 

§ 2.51 Medical emergencies. 

(a) General Rule. Under the procedures required 
by paragraph (c) of this section, patient identifying 
information may be disclosed to medical personnel 
who have a need for information about a patient 
for the purpose of treating a condition which poses 
an immediate threat to the health of any individual 
and which requires immediate medical intervention. 

(b) Special Rule. Patient identifying infoimation 
may be disclosed to medical personnel of the Food 
and Drug Administration (FDA) who assert a 
reason to believe that the health of any individual 
may be threatened by an error in the manufacture, 
labeling, or sale of a product under FDA 
jurisdiction, and that the infoimation will be used 
for the exclusive purpose of notifying patients or 
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their physicians of potential dangers. 

(c) Procedures. Immediately following disclosure, the 
program shall document the disclosure in the 
patient’s records, setting forth in writing: 

(1) The name of the medical personnel to whom 
disclosure was made and their affiliation with any 
health care facility; 

(2) The name of the individual making the disclosure; 

(3) The date and time of the disclosure; and 

(4) The nature of the emergency (or error, if the 
report was to FDA). 

(Approved by the Office of Management and Budget 
under control number 0930-0099) 


§ 2.52 Research activities. 

(a) Patient identifying information may be disclosed 
for the puipose of conducting scientific research if 
the program director makes a determination that the 
recipient of the patient identifying information: 

(1) Is qualified to conduct the research; 

(2) Has a research protocol under which the patient 
identifying information: 

(i) Will be maintained in accordance with the security 
requirements of § 2.16 of these regulations (or more 
stringent requirements); and 

(ii) Will not be redisclosed except as permitted under 
paragraph (b) of this section; and 

(3) Has provided a satisfactory written statement 
that a group of three or more individuals who are 
independent of the research project has reviewed 
the protocol and determined that: 

(i) The rights and welfare of patients will be 
adequately protected; and 

(ii) The risks in disclosing patient identifying 
information are outweighed by the potential benefits 
of the research. 

(b) A person conducting research may disclose 
patient identifying information obtained under 
paragraph (a) of this section only back to the 
program from which that information was obtained 
and may not identify any individual patient in any 
report of that research or otherwise disclose patient 
identities. 

[52 FR 21809, June 9, 1987, as amended at 52 FR 
41997, Nov. 2, 1987] 

§ 2.53 Audit and evaluation activities. 

(a) Records not copied or removed. If patient 
records are not copied or removed, patient identifying 
information may be disclosed in the course of a 
review of records on program premises to any person 
who agrees in writing to comply with the limitations 
on redisclosure and use in paragraph (d) of this 
section and who: 

(1) Performs the audit or evaluation activity on behalf 
of: 

(i) Any Federal, State, or local governmental agency 
which provides financial assistanceto the program or is 
authorized by law to regulate its activities; or 

(ii) Any private person which provides financial 
assistanceto the program, which is a third party payer 
covering patients in the program, or which is a peer 
review organization performing a utilization or quality 
control review; or 
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(2) Is determined by the program director to be 
qualified to conduct the audit or evaluation activities. 

(b) Copying or removal of records. Records 
containing patient identifying information may be 
copied or removed from program premises by any 
person who: 

(1) Agrees in writing to: 

(1) Maintain the patient identifying information in 
accordancewith the security requirements provided in 
§ 2.16 of these regulations (or more stringent requirements); 

(ii) Destroy all the patient identifying information upon 
completion of the audit or evaluation; and 

(iii) Comply with the limitations on disclosure and use in 
paragraph (d) of this section; and 

(2) Performs the audit or evaluation activity on behalf 
of: 

(1) Any Federal, State, or local governmental agency 
which provides f inancial assistance to the program or is 
authorized by law to regulate its activities; or 

(ii) Any private person which provides financial 
assistance to the program, which is a third part payer 
covering patients in the program, or which is a peer 
review organization performing a utilization or quality 
control review. 

(c) Medicare or Medicaid audit or evaluation. (1) 
For purposes of Medicare or Medicaid audit or 
evaluation under this section, audit or evaluation 
includes a civil or administrative investigation of the 
program by any Federal, State, or local agency 
responsible for oversight of the Medicare or Medicaid 
program and includes administrative enforcement, 
against the program by the agency, of any remedy 
authorized by law to be imposed as a result of the 
findings of the investigation. 

(2) Consistent with the definition of program in § 2.11, 
program includes an employee of, or provider of medical 
services under, the program when the employee or 
provider is the subject of a civil investigation or 
administrative remedy, as those terms are used in 
paragraph (c)(1) of this section. 

(3) If a disclosure to a person is authorized under this 
section for a Medicare or Medicaid audit or evaluation, 
including a civil investigation or administrative remedy, 
as those terms are used in paragraph (c)(1) of this 
section, then a peer review organization which obtains 
the inf ormation under paragraph (a) or (b) may disclose 
the inf ormation to that person but only for purposes of 
Medicare or Medicaid audit or evaluation. 

(4) The provisions of this paragraph do not authorize 
the agency, the program, or any other person to 
discloseorusepatient identifying information obtained 


during the audit or evaluation for any purposes other than 
those necessary to complete the Medicare or Medicaid audit or 
evaluation activity as specified in this paragraph. 

(d) Limitations on disclosure and use. Except as 
provided in paragraph (c) of this section, patient 
identifying information disclosed under this section 
may be disclosed only back to the program from 
which it was obtained and used only to carry out an 
audit or evaluation purpose or to investigate or 
prosecute criminal or other activities, as authorized 
by a court order entered under § 2.66 of these 
regulations. 

Subpart E—Court Orders 
Authorizing Disclosure and Use 

§ 2.61 Legal effect of order. 

(a) Effect. An order of a court of competent 
jurisdiction entered under this subpart is a unique 
kind of court order. Its only purpose is to authorize 
a disclosure or use of patient information which 
would otherwise be prohibited by 42 U.S.C. 
290ee-3, 42 U.S.C. 290dd-3 and these regulations. 
Such an order does not compel disclosure. A 
subpoena or a similar legal mandate must be issued in 
order to compel disclosure. This mandate may be 
entered at the same time as and accompany an 
authorizing court order entered under these 
regulations. 

(b) Examples. (1) A person holding records subject 
to these regulations receives a subpoena for those 
records: a response to the subpoena is not permitted 
under the regulations unless an authorizing court 
order is entered. The person may not disclose the 
records in response to the subpoena unless a court of 
competent jurisdiction enters an authorizing order 
under these regulations. 

(2) An authorizing court order is entered under 
these regulations, but the person authorized does 
not want to make the disclosure. If there is no 
subpoena or other compulsory process or a 
subpoena for the records has expired or been 
quashed, that person may refuse to make the 
disclosure. Upon the entry of a valid subpoena or 
other compulsory process the person authorized to 
disclose must disclose, unless there is a valid legal 
defense to the process other than the confi- 
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dentiality restrictions of these regulations. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.62 Order not applicable to records disclosed 
without consent to researchers, auditors and 
evaluators. 

A court order under these regulations may not 
authorize qualified personnel, who have received 
patient identifying information without consent for 
the purpose of conducting research, audit or 
evaluation, to disclose that information or use it to 
conduct any criminal investigation or prosecution 
of a patient. However, a court order under § 2.66 
may authorize disclosure and use of records to 
investigate or prosecute qualified personnel holding 
the records. 

§ 2.63 Confidential communications. 

(a) A court order under these regulations may 
authorize disclosure of confidential 
communications made by a patient to a program in 
the course of diagnosis, treatment, or referral for 
treatment only if: 

(1) The disclosure is necessary to protect against 
an existing threat to life or of serious bodily 
injury, including circumstances which constitute 
suspected child abuse and neglect and verbal 
threats against third parties; 

(2) The disclosure is necessary in connection 
with investigation or prosecution of an extremely 
serious crime, such as one which directly 
threatens loss of life or serious bodily injury, 
including homicide, rape, kidnaping, armed 
robbery, assault with a deadly weapon, or child 
abuse and neglect; or 

(3) The disclosure is in connection with litigation 
or an administrative proceeding in which the 
patient offers testimony or other evidence 
pertaining to the content of the confidential 
communications. 

(b) [Reserved] 


(a) Application. An order authorizing the disclosure 
of patient records for purposes other than criminal 
investigation or prosecution may be applied for by 
any person having a legally recognized interest in 
the disclosure which is sought. The application may 
be filed separately or as part of a pending civil 
action in which it appeal's that the patient records 
are needed to provide evidence. An application 
must use a fictitious name, such as John Doe, to 
refer to any patient and may not contain or 
otherwise disclose any patient identifying 
infoimation unless the patient is the applicant or 
has given a written consent (meeting the 
requirements of these regulations) to disclosure or 
the court has ordered the record of the proceeding 
sealed from public scrutiny. 

(b) Notice. The patient and the person holding the 
records from whom disclosure is sought must be 
given: 

(1) Adequate notice in a manner which will not 
disclose patient identifying information to other 
persons; and 

(2) An opportunity to file a written response to 
the application, or to appear in person, for the 
limited purpose of providing evidence on the 
statutory and regulatory criteria for the issuance 

of the court order. 


§ 2.64 Procedures and criteria for orders 
authorizing disclosures for noncriminal 
purposes. 
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(c) Review of evidence: Conduct of hearing. Any 
oral argument, review of evidence, or hearing on 
the application must be held in the judge’s 
chambers or in some manner which ensures that 
patient identifying information is not disclosed to 
anyone other than a party to the proceeding, the 
patient, or the person holding the record, unless the 
patient requests an open hearing in a manner which 
meets the written consent requirements of these 
regulations. The proceeding may include an 
examination by the judge of the patient records 
referred to in the application. 

(d) Criteria for entry of order. An order under this 
section may be entered only if the court determines 
that good cause exists. To make this determination 
the court must find that: 

(1) Other ways of obtaining the information are 
not available or would not be effective; and 

(2) The public interest and need for the 
disclosure outweigh the potential injury to the 
patient, the physician-patient relationship and 
the treatment services. 

(e) Content of order. An order authorizing a 
disclosure must: 

(1) Limit disclosure to those parts of the patient’s 
record which are essential to fulfill the objective 
of the order; 

(2) Limit disclosure to those persons whose need 
for information is the basis for the order; and 

(3) I nclude such other measures as are 
necessary to limit disclosure for the protection of 
the patient, the physician patient relationship and 
the treatment services; for example, sealing 
from public scrutiny the record of any proceeding 
for which disclosure of a patient’s record has been 
ordered. 

§ 2.65 Procedures and criteria for orders 
authorizing disclosure and use of records to 
criminally investigate or prosecute patients. 

(a) Application. An order authorizing the 
disclosure or use of patient records to criminally 
investigate or prosecute a patient may be applied 
for by the person holding the records or by any 
person conducting investigative or prosecutorial 
activities with respect to the enforcement of 
criminal laws. The application may be filed 
separately, as paid of an application for a subpoena 
or other compulsory process, or in a pending 


criminal action. An application must use a fictitious 
name such as John Doe, to refer to any patient and 
may not contain or otherwise disclose patient 
identifying information unless the court has ordered 
the record of the proceeding sealed from public 
scrutiny. 

(b) Notice and hearing. Unless an order under § 
2.66 is sought with an order under this section, the 
person holding the records must be given: 

(1) Adequate notice (in a manner which will not 
disclose patient identifying information to third 
parties) of an application by a person performing 
a law enforcement function; 

(2) An opportunity to appear and be heard for the 
limited purpose of providing evidence on the 
statutory and regulatory criteria for the issuance 
of the court order; and 

(3) An opportunity to be represented by counsel 
independent of counsel for an applicant who is a 
person performing a law enforcement function. 

(c) Review of evidence: Conduct of hearings. Any 
oral argument, review of evidence, or hearing on 
the application shall be held in the judge's 
chambers or in some other manner which ensures 
that patient identifying information is not disclosed 
to anyone other than a party to the proceedings, the 
patient, or the person holding the records. The 
proceeding may include an examination by the 
judge of the patient records referred to in the 
application. 

(d) Criteria. A court may authorize the disclosure 
and use of patient records for the purpose of 
conducting a criminal investigation or prosecution 
of a patient only if the court finds that all of the 
following criteria are met: 

(1) The crime involved is extremely serious, such 
as one which causes or directly threatens loss of 
life or serious bodily injury including homicide, 
rape, kidnaping, armed robbery, assault with a 
deadly weapon, and child abuse and neglect. 

(2) There is a reasonable likelihood that the 
records will disclose information of substantial 
value in the investigation or prosecution. 

(3) Other ways of obtaining the information are 
not available or would not be effective. 
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(4) The potential injury to the patient, to the 
physician-patient relationship and to the 
ability of the program to provide services to 
other patients is outweighed by the public 
interest and the need for the disclosure. 

(5) I f the applicant is a person performing a law 
enforcement function that: 

(i) The person holding the records has been 
afforded the opportunity to be represented by 
independent counsel; and 

(ii) Any person holding the records which is an 
entity within Federal, State, or local government 
has in fact been represented by counsel 
independent of the applicant. 

(e) Content of order. Any order authorizing a 
disclosure or use of patient records under this 
section must: 

(1) Limit disclosure and use to those parts of the 
patient’s record which are essential to fulfill the 
objective of the order; 

(2) Limit disclosure to those law enforcement and 
prosecutorial officials who are responsible for, or 
are conducting, the investigation or prosecution, 
and limit their use of the records to investigation 
and prosecution of extremely serious crime or 
suspected crime specified in the application; and 

(3) I nclude such other measures as are 
necessary to limit disclosure and use to the 
fulfillment of only that public interest and need 
found by the court. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.66 Procedures and criteria for orders 
authorizing disclosure and use of records to 
investigate or prosecute a program or the 
person holding the records. 

(a) Application. (1) An order authorizing the 
disclosure or use of patient records to criminally or 
administratively investigate or prosecute a program 
or the person holding the records (or employees or 
agents of that program or person) may be applied 
for by any administrative, regulatory, supervisory, 
investigative, law enforcement, or prosecutorial 
agency having jurisdiction over the program’s or 
person’s activities. 

(2) The application may be filed separately or as 


part of a pending civil or criminal action against a 
program or the person holding the records (or 
agents or employees of the program or person) in 
which it appears that the patient records are 
needed to provide material evidence. The 
application must use a fictitious name, such as 
J ohn Doe, to refer to any patient and may not 
contain or otherwise disclose any patient 
identifying information unless the court has 
ordered the record of the proceeding sealed from 
public scrutiny or the patient has given a written 
consent (meeting the requirements of § 2.31 of 
these regulations) to that disclosure. 

(b) Notice not required. An application under this 
section may, in the discretion of the court, be 
granted without notice. Although no express notice 
is required to the program, to the person holding 
the records, or to any patient whose records are to 
be disclosed, upon implementation of an order so 
granted any of the above persons must be afforded 
an opportunity to seek revocation or amendment of 
that order, limited to the presentation of evidence 
on the statutory and regulatory criteria for the 
issuance of the court order. 

(c) Requirements for order. An order under this 
section must be entered in accordance with, and 
comply with the requirements of, paragraphs (d) 
and (e) of § 2.64 of these regulations. 

(d) Limitations on disclosure and use of patient 
identifying information: 

(1) An order entered under this section must 
require the deletion of patient identifying 
information from any documents made available 
to the public. 

(2) No information obtained under this section 
may be used to conduct any investigation or 
prosecution of a patient, or be used as the basis 
for an application for an order under § 2.65 of 

these regulations. 

§ 2.67 Orders authorizing the use of undercover 
agents and informants to criminally investigate 
employees or agents of a program. 

(a) Application. A court order authorizing the 
placement of an undercover agent or informant in a 
program as an employee or patient may be applied 
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for by any law enforcement or prosecutorial 
agency which has reason to believe that employees 
or agents of the program are engaged in criminal 
misconduct. 

(b) Notice. The program director must be given 
adequate notice of the application and an 
opportunity to appeal - and be heard (for the limited 
purpose of providing evidence on the statutory and 
regulatory criteria for the issuance of the court 
order), unless the application asserts a belief that: 

(1) The program director is involved in the 
criminal activities to be investigated by the 
undercover agent or informant; or 

(2) The program director will intentionally or 
unintentionally disclose the proposed placement 
of an undercover agent or informant to the 
employees or agents who are suspected of 
criminal activities. 

(c) Criteria. An order under this section may be 
entered only if the court determines that good 
cause exists. To make this determination the court 
must find: 

(1) There is reason to believe that an employee 
or agent of the program is engaged in criminal 
activity; 

(2) Other ways of obtaining evidence of this 
criminal activity are not available or would not be 
effective; and 

(3) The public interest and need for the 
placement of an undercover agent or informant in 
the program outweigh the potential injury to 
patients of the program, physician-patient 
relationships and the treatment services. 

(d) Content of order. An order authorizing the 
placement of an undercover agent or informant in a 
program must: 

(1) Specifically authorize the placement of an 
undercover agent or an informant; 

(2) Limit the total period of the placement to six 
months; 

(3) Prohibit the undercover agent or informant 
from disclosing any patient identifying 
information obtained from the placement except 
as necessary to criminally investigate or 
prosecute employees or agents of the program; 
and 


(4) I nclude any other measures which are 
appropriate to limit any potential disruption of 
the program by the placement and any potential 
for a real or apparent breach of patient 
confidentiality; for example, sealing from public 
scrutiny the record of any proceeding for which 
disclosure of a patient’s record has been ordered. 

(e) Limitation on use of information. No 
infoimation obtained by an undercover agent or 
informant placed under this section may be used to 
criminally investigate or prosecute any patient or as 
the basis for an application for an order under § 
2.65 of these regulations. 
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Appendix A—The Federal Confidentiality Law 
and Regulations 
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SUBCHAPTER A—GENERAL PROVISIONS 


PART 1 [RESERVED] 

PART 2—CONFIDENTIALITY OF 
ALCOHOL AND DRUG ABUSE 
PATIENT RECORDS 

Subpart A—Introduction 

Sec. 

2.2 Statutory authority for confidentiality of 

alcohol abuse patient records. 

2.3 Purpose and effect. 

2.4 Criminal penalty for violation. 

2.5 Reports of violations. 

Subpart B—General Provisions 

2.11 Definitions. 

2.12 Applicability. 

2.13 Confidentiality restrictions. 

2.14 Minor patients. 

2.15 Incompetent and deceased patients. 

2.16 Security for written records. 

2.17 Undercover agents and informants. 

2.18 Restrictions on the use of identification 
cards. 

2.19 Disposition of records by discontinued pro¬ 
grams. 

2.20 Relationship to State laws. 

2.21 Relationship to Federal statutes protecting 
research subjects against compulsory dis¬ 
closure of their identity. 

2.22 Notice to patients of Federal confidentiality 
requirements. 

2.23 Patient access and restriction on use. 

Subpart C—Disclosures With Patient’s Consent 

2.31 Form of written consent. 

2.32 Prohibition on redisclosure. 

2.33 Disclosures permitted with written consent. 

2.34 Disclosures to prevent multiple enrollments in 
detoxification and maintenance treatment 
programs. 

2.35 Disclosures to elements of the criminal justice 
system which have referred patients. 


Subpart D—Disclosures Without Patient 
Consent 

2.51 Medical emergencies. 

2.52 Research activities. 

2.53 Audit and evaluation activities. 

Subpart E—Court Orders Authorizing 
Disclosures and Use 

2.61 Legal effect of order. 

2.62 Order not applicable to records disclosed 
without consent to researchers, auditors 
and evaluators. 

2.63 Confidential communications. 

2.64 Procedures and criteria for orders 

authorizing disclosures for noncriminal 
purposes. 

2.65 Procedures and criteria for orders 

authorizing disclosure and use of records to 
criminally investigate or prosecute patients. 

2.66 Procedures and criteria for orders 

authorizing disclosure and use of records to 
investigate or prosecute a program or the 
person holding the records. 

2.67 Orders authorizing the use of undercover 
agents and informants to criminally 
investigate employees or agents of a 
program. 

AUTHORITY: Sec. 408 of Pub. L. 92-255, 86 
Stat. 79, as amended by sec. 303 (a), (b) of Pub L. 

93- 282, 83 Stat. 137, 138; sec. 4(c)(5)(A) of Pub. L. 

94- 237,90 Stat. 244; sec. 111(c)(3) of Pub. L. 94-581, 
90 Stat. 2852; sec. 509 of Pub. L. 96-88,93 Stat. 695; 
sec. 973(d) of Pub. L. 97- 35, 95 Stat. 598; and 
transferred to sec. 527 of the Public Health Service Act 
by sec. 2(b)(16)(B) of Pub. L. 98-24,97 Stat. 182 and 
as amended by sec. 106 of Pub. L. 99-401, 100 Stat. 
907 (42 U.S.C. 290ee-3) and sec. 333 of Pub. L. 
91-616, 84 Stat. 1853, as amended by sec. 122(a) of 
Pub. L. 93-282,88 Stat. 131; and sec. 111(c)(4) of Pub. 
L. 94-581, 90 Stat. 2852 and transferred to sec. 523 of 
the Public Health Service Act by sec. 2(b)(13) of Pub. L. 
98-24,97 Stat. 181 and as amended by sec. 106ofPub. 
L. 99-401, 100 Stat. 907 (42 U.S.C. 290dd-3), as 
amendedby sec. 131 ofPub.L. 102-321,106Stat.368, 
(42 U.S.C. 290dd-2). 
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SOURCE: 52 FR 21809, June 9, 1987, unless 
otherwise noted. 

Subpart A—Introduction 

§2.1 Statutory authority for confidentiality of 
drug abuse patient records. 

The restrictions of these regulations upon 
the disclosure and use of drug abuse patient 
records were initially authorized by section 408 
of the Drug Abuse Prevention, Treatment, and 
Rehabilitation Act (21 U.S.C. 1175). That 
section as amended was transferred by Pub. L. 
98-24 to section 527 of the Public Health 
Service Act which is codified at 42 CFR Ch. I 
(10-1-97 Edition § 2.2 at 42 U.S.C. 290ee-3. The 
amended statutory authority is set forth below: 

§ 290ee-3. CONFIDENTIALITY OF PATIENT 
RECORDS. 

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or 
treatment of any patient which are maintained in 
connection with the performance of any drug abuse 
prevention function conducted, regulated, or directly or 
indirectly assisted by any department or agency of the 
United States shall, except as provided in subsection (e) 
of this section, be confidential and be disclosed only for 
the purposes and under the circumstances 
expressly authorized under subsection (b) of this 
section. 

(b) Purposes and circumstances of disclosure 
affecting consenting patient and patient regardless 
of consent 

(1) The content of any record referred to in 
subsection (a) of this section may be disclosed in 
accordance with the prior written consent of the 
patient with respect to whom such record is 
maintained, but only to such extent, under such 
circumstances, and for such purposes as may be 
allowed under regulations prescribed pursuant to 
subsection (g) of this section. 

(2) Whether or not the patient, with respect to 
whom any given record referred to in subsection (a) of 
this section is maintained, gives his written consent, 
the content of such record may be disclosed as 
follows: 

(A) To medical personnel to the extent necessary 
to meet a bona fide medical emergency. 

(B) To qualified personnel for the purpose of 
conducting scientific research, management audits, 
financial audits, or program evaluation, but such 
personnel may not identify, directly or indirectly, any 
individual patient in any report of such research, audit. 


or evaluation, or otherwise disclose patient identities 
in any manner. 

(C) If authorized by an appropriate order of a court of 
competent jurisdiction granted after application 
showing good cause therefor. In assessing good cause 
the court shall weigh the public interest and the need 
for disclosure against the injury to the patient, to the 
physician patient relationship, and to the treatment 
services. Upon the granting of such order, the court, in 
determining the extent to which any disclosure of all 
or any part of any record is necessary, shall impose 
appropriate safeguards against unauthorized 
disclosure. 

(c) Prohibition against use of record in making 

criminal charges or investigation of patient 
Except as authorized by a court order granted under 
subsection (b)(2)(C) of this section, no record referred 
to in subsection (a) of this section may be used to 
initiate or substantiate any criminal charges against a 
patient or to 

conduct any investigation of a patient. 

(d) Continuing prohibition against disclosure 
irrespective of status as patient 

The prohibitions of this section continue to apply to 
records concerning any individual who has been a 
patient, irrespective of whether or when he ceases to be 
a patient. 

(e) Armed Forces and Veterans’ Administration; 
interchange of records; report of suspected child 
abuse and neglect to State or local authorities 

The prohibitions of this section do not apply to any 
interchange of records— 

(1) within the Armed Forces or within those components 
of the Veterans’ Administration furnishing health care to 
veterans, or 

(2) between such components and the Armed Forces. 
The prohibitions of this section do not apply to the 
reporting under State law of incidents of suspected child 
abuse and neglect to the appropriate State or local 
authorities. 

(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section or 
any regulation issued pursuant to this section shall be 
fined not more than $500 in the case of a first offense, 
and not more than $5,000 in the case of each subsequent 
offense. 

(g) Regulations; interagency consultations; 
definitions, safeguards, and procedures, including 
procedures and criteria for issuance and scope of 
orders 

Except as provided in subsection (h) of this section, the 
Secretary, after consultation with the Administrator of 
Veterans’ Affairs and the heads of other Federal 
departments and agencies substantially affected thereby, 



shall prescribe regulations to carry out the purposes of 
this section. These regulations may contain such 
definitions, and may provide for such safeguards and 
procedures, including procedures and criteria for the 
issuance and scope of orders under subsection (b)(2)(C) 
of this section, as in the judgment of the Secretary are 
necessary or proper to effectuate the purposes of this 
section, to prevent circumvention or evasion thereof, or 
to facilitate compliance therewith. 

(Subsection (h) was superseded by section 111(c)(3) of 
Pub. L. 94-581. The responsibility of the Administrator 
of Veterans’ Affairs to write regulations to provide for 
confidentiality of drug abuse patient records under Title 
38 was moved from 2*1 U.S.C. 1175 to 38 U.S.C. 4134.) 

§ 2.2 Statutory authority for confidentiality of 
alcohol abuse patient records. 

The restrictions of these regulations upon the 
disclosure and use of alcohol abuse patient records 
were initially authorized by section 333 of the 
Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment, and Rehabilitation Act of 
1970 (42 U.S.C. 4582). The section as amended was 
transferred by Pub. L. 98-24 to section 523 of the 
Public Health Service Act which is codified at 42 
U.S.C. 290dd-3. The amended statutory authority is 
set forth below: 

§ 290dd-3. CONFIDENTIALITY OF PATIENT 
RECORDS 

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or 
treatment of any patient which are maintained in 
connection with the performance of any program or 
activity relating to alcoholism or alcohol abuse 
education, training, treatment, rehabilitation, or 
research, which is conducted, regulated, or directly or 
indirectly assisted by any department or agency of the 
United States shall, except as provided in subsection 
(e) of this section, be confidential and be disclosed 
only for the purposes and under the circumstances 
expressly authorized under subsection (b) of this 
section. 

(b) Purposes and circumstances of disclosure 
affecting consenting patient and patient regardless 
of consent 

(1) The content of any record referred to in 
subsection (a) of this section may be disclosed in 
accordance with the prior written consent of the 
patient with respect to whom such record is 
maintained, but only to such extent, under such 
circumstances, and for such purposes as may be 


allowed under regulations prescribed pursuant to 
subsection (g) of this section. 

(2) Whether or not the patient, with respect to whom 
any given record referred to in subsection (a) of this 
section is maintained, gives his written consent, the 
content of such record may be disclosed as follows: 

(A) To medical personnel to the extent necessary to 
meet a bona fide medical emergency. 

(B) To qualified personnel for the purpose of 
conducting scientific research, management audits, 
financial audits, or program evaluation, but such 
personnel may not identify, directly or indirectly, any 
individual patient in any report of such research, audit, 
or evaluation, or otherwise disclose patient identities 
in any manner. 

(C) If authorized by an appropriate order of a court of 
competent jurisdiction granted after application 
showing good cause therefor. In assessing good cause 
the court shall weigh the public interest and the need 
for disclosure against the injury to the patient, to the 
physician patient relationship, and to the treatment 
services. Upon the granting of such order, the court, in 
determining the extent to which any disclosure of all 
or any part of any record is necessary, shall impose 
appropriate safeguards against unauthorized 
disclosure. 

(c) Prohibition against use of record in making 
criminal charges or investigation of patient 
Except as authorized by a court order granted under 
subsection (b)(2)(C) of this section, no record 
referred to in subsection (a) of this section may be 
used to initiate or substantiate any criminal charges 
against a patient or to conduct any investigation of a 
patient. 

(d) Continuing prohibition against disclosure 
irrespective of status as patient 

The prohibitions of this section continue to apply to 
records concerning any individual who has been a 
patient, irrespective of whether or when he ceases to 
be a patient. 

(e) Armed Forces and Veterans ’ Administration; 
interchange of record of suspected child abuse and 
neglect to State or local authorities 

The prohibitions of this section do not apply to any 
interchange of records— 

(1) within the Armed Forces or within those 
components of the Veterans’ Administration 
furnishing health care to veterans, or 

(2) between such components and the Armed Forces. 
The prohibitions of this section do not apply to the 
reporting under State law of incidents of suspected 
child abuse and neglect to the appropriate State or 
local authorities. 
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(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section 
or any regulation issued pursuant to this section shall 
be fined not more than $500 in the case of a first 
offense, and not more than $5,000 in the case of each 
subsequent offense. 

(g) Regulations of Secretary; definitions, 
safeguards, and procedures, including procedures 
and criteria for issuance and scope of orders 
Except as provided in subsection (h) of this section, 
the Secretary shall prescribe regulations to carry out 
the purposes of this section. These regulations may 
contain such definitions, and may provide for such 
safeguards and procedures, including procedures and 
criteria for the issuance and scope of orders under 
subsection(b)(2)(C) of this section, as in the judgment 
of the Secretary are necessary or proper to effectuate 
the purposes of this section, to prevent circumvention 
or evasion thereof, or to facilitate compliance 
therewith. 

(Subsection (h) was superseded by section 111(c)(4) 
of Pub. L. 94-581. The responsibility of the 
Administrator of Veterans’ Affairs to write 
regulations to provide for confidentiality of alcohol 
abuse patient records under Title 38 was moved from 
42 U.S.C. 4582 to 38 U.S.C. 4134.) 


§ 2.3 Purpose and effect. 

(a) Purpose. Under the statutory provisions quoted in 
§§2.1 and 2.2, these regulations impose restrictions 
upon the disclosure and use of alcohol and drug abuse 
patient records which are maintained in connection 
with the performance of any federally assisted alcohol 
and drug abuse program. The regulations specify: 

(1) Definitions, applicability, and general 
restrictions in subpart B (definitions applicable to § 
2.34 only appear in that section); 

(2) Disclosures which may be made with written 
patient consent and the form of the written consent 
in subpart C; 

(3) Disclosures which may be made without 
written patient consent or an authorizing court 
order in subpart D; and 

(4) Disclosures and uses of patient records which 
may be made with an authorizing court order and 
the procedures and criteria for the entry and scope 
of those orders in subpart E. 

(b) Effect. (1) These regulations prohibit the 
disclosure and use of patient records unless certain 
circumstances exist. If any circumstances exists under 
which disclosure is permitted, that circumstance acts 


to remove the prohibition on disclosure but it does not 
compel disclosure. Thus, the regulations do not 
require disclosure under any circumstances. 

(2) These regulations are not intended to direct the 
manner in which substantive functions such as 
research, treatment, and evaluation are carried out. 
They are intended to insure that an alcohol or drug 
abuse patient in a federally assisted alcohol or drug 
abuse program is not made more vulnerable by 
reason of the availability of his or her patient record 
than an individual who has an alcohol or drug 
problem and who does not seek treatment. 

(3) Because there is a criminal penalty (a fine—see 
42 U.S.C. 290ee-3(f), 42 U.S.C. 290dd-3(f) and 
42 CFR 2.4) for violating the regulations, they are 
to be construed strictly in favor of the potential 
violator in the same manner as a criminal statute 
(see M. Kraus & Brothers v. United States, 327 
U.S. 614, 621-22, 66 S. Ct. 705, 707-08 (1946)). 

§ 2.4 Criminal penalty for violation. 

Under 42 U.S.C. 290ee-3(f) and 42 U.S.C. 
290dd-3(f), any person who violates any provision 
of those statutes or these regulations shall be fined 
not more than $500 in the case of a first offense, 
and not more than $5,000 in the case of each 
subsequent offense. 

§ 2.5 Reports of violations. 

(a) The report of any violation of these regulations 
may be directed to the United States Attorney for 
the judicial district in which the violation occurs. 

(b) The report of any violation of these regulations 
by a methadone program may be directed to the 
Regional Offices of the Food and Drug 
Administration. 


Subpart B—General Provisions 

§ 2.11 Definitions. 

For purposes of these regulations: 

Alcohol abuse means the use of an alcoholic 
beverage which impairs the physical, mental, 
emotional, or social well-being of the user. 

Drug abuse means the use of a psychoactive 
substance for other than medicinal purposes which 
impairs the physical, mental, emotional, or social 
well-being of the user. 

Diagnosis means any reference to an individual’s 
alcohol or drug abuse or to a condition which is 
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identified as having been caused by that abuse 
which is made for the purpose of treatment or 
referral for treatment. 

Disclose or disclosure means a communication of 
patient identifying information, the affirmative 
verification of another person’s communication of 
patient identifying information, or the 
communication of any information from the record 
of a patient who has been identified. 

Informant means an individual: 

(a) Who is a patient or employee of a program or 
who becomes a patient or employee of a program 
at the request of a law enforcement agency or 
official: and 

(b) Who at the request of a law enforcement 
agency or official observes one or more patients or 
employees of the program for the purpose of 
reporting the information obtained to the law 
enforcement agency or official. 

Patient means any individual who has applied for 
or been given diagnosis or treatment for alcohol or 
drug abuse at a federally assisted program and 
includes any individual who, after arrest on a 
criminal charge, is identified as an alcohol or drug 
abuser in order to determine that individual’s 
eligibility to participate in a program. 

Patient identifying information means the name, 
address, social security number, fingerprints, 
photograph, or similar information by which the 
identity of a patient can be determined with 
reasonable accuracy and speed either directly or by 
reference to other publicly available information. 
The term does not include a number assigned to a 
patient by a program, if that number does not 
consist of, or contain numbers (such as a social 
security, or driver’s license number) which could 
be used to identify a patient with reasonable 
accuracy and speed from sources external to the 
program. 

Person means an individual, partnership, 
corporation, Federal, State or local government 
agency, or any other legal entity. 

Program means: 

(a) An individual or entity (other than a general 
medical care facility) who holds itself out as 
providing, and provides, alcohol or drug abuse 
diagnosis, treatment or referral for treatment; or 

(b) An identified unit within a general medical 
facility which holds itself out as providing, and 
provides, alcohol or drug abuse diagnosis, 
treatment or referral for treatment; or 

(c) Medical personnel or other staff in a general 
medical care facility whose primary function is the 
provision of alcohol or drug abuse diagnosis, 


treatment or referral for treatment and who are 
identified as such providers. (See § 2.12(e)(1) for 
examples.) 

Program director means: 

(a) In the case of a program which is an individual, 
that individual; 

(b) In the case of a program which is an 
organization, the individual designated as director, 
managing director, or otherwise vested with 
authority to act as chief executive of the 
organization. 
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Qualified Service Organization means a 
person which: 

(a) Provides services to a program, such as data 
processing, bill collecting, dosage preparation, 
laboratory analyses, or legal, medical, accounting, 
or other professional services, or services to 
prevent or treat child abuse or neglect, including 
training on nutrition and child care and individual 
and group therapy, and 

(b) Has entered into a written agreement with a 
program under which that person: 

(1) Acknowledges that in receiving, storing, 
processing or otherwise dealing with any patient 
records from the programs, it is fully bound by 
these regulations; and 

(2) If necessary, will resist in judicial proceedings 
any efforts to obtain access to patient records 
except as permitted by these regulations. 

Records means any information, whether recorded 
or not, relating to a patient received or acquired by 
a federally assisted alcohol or drug program. 

Third party payer means a person who pays, or 
agrees to pay, for diagnosis or treatment furnished 
to a patient on the basis of a contractual 
relationship with the patient or a member of his 
family or on the basis of the patient’s eligibility for 
Federal, State, or local governmental benefits. 
Treatment means the management and care of a 
patient suffering from alcohol or drug abuse, a 
condition which is identified as having been caused 
by that abuse, or both, in order to reduce or 
eliminate the adverse effects upon the patient. 

Undercover agent means an officer of any 
Federal, State, or local law enforcement agency who 
enrolls in or becomes an employee of a program for 
the purpose of investigating a suspected violation of 
law or who pursues that purpose after enrolling or 
becoming employed for other purposes. 

[52 FR 21809, June 9, 1987, as amended by 60 FR 
22297, May 5, 1995] 


(2) It is being carried out under a license, 
certification, registration, or other authorization 
granted by any department or agency of the United 
States including but not limited to: 


§ 2.12 Applicability. 

(a) General —(1) Restrictions on disclosure. The 
restrictions on disclosure in these regulations apply 
to any information, whether or not recorded, which: 

(1) Would identify a patient as an alcohol or drug 
abuser either directly, by reference to other publicly 
available information, or through verification of 
such an identification by another person; and 

(ii) Is drug abuse information obtained by a 
federally assisted drug abuse program after March 
20, 1972, or is alcohol abuse information obtained 
by a federally assisted alcohol abuse program after 
May 13, 1974 (or if obtained before the pertinent 
date, is maintained by a federally assisted alcohol or 
drug abuse program after that date as part of an 
ongoing treatment episode which extends past that 
date) for the purpose of treating alcohol or drug 
abuse, making a diagnosis for that treatment, or 
making a referral for that treatment. 

(2) Restriction on use. The restriction on use of 
information to initiate or substantiate any criminal 
charges against a patient or to conduct any criminal 
investigation of a patient (42 U.S.C. 290ee-3(c), 42 
U.S.C. 290dd-3(c)) applies to any information, 
whether or not recorded which is drug abuse 
information obtained by a federally assisted drug 
abuse program after March 20, 1972, or is alcohol 
abuse information obtained by a federally assisted 
alcohol abuse program after May 13, 1974 (or if 
obtained before the pertinent date, is maintained by 
a federally assisted alcohol or drug abuse program 
after that date as part of an ongoing treatment 
episode which extends past that date), for the 
purpose of treating alcohol or drug abuse, making a 
diagnosis for the treatment, or making a referral for 
the treatment. 

(b) Federal assistance. An alcohol abuse or drug 
abuse program is considered to be federally assisted 
if: 

(1) It is conducted in whole or in part, whether 
directly or by contract or otherwise by any 
department or agency of the United States (but see 
paragraphs (c)(1) and (c)(2) of this section relating 
to the Veterans’ Administration and the Armed 
Forces); 


(i) Certification of provider status under the 
Medicare program; 

(ii) Authorization to conduct methadone 
maintenance treatment (see 21 CFR 291.505); or 
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(iii) Registration to dispense a substance under the 
Controlled Substances Act to the extent the 
controlled substance is used in the treatment of 
alcohol or drug abuse; 

(3) It is supported by funds provided by any 
department or agency of the United States by 
being: 

(1) A recipient of Federal financial assistance in any 
form, including financial assistance which does not 
directly pay for the alcohol or drug abuse diagnosis, 
treatment, or referral activities; or 

(ii) Conducted by a State or local government unit 
which, through general or special revenue sharing 
or other forms of assistance, receives Federal funds 
which could be (but are not necessarily) spent for 
the alcohol or drug abuse program; or 

(4) It is assisted by the Internal Revenue Service of 
the Department of the Treasury through the 
allowance of income tax deductions for 
contributions to the program or through the 
granting of tax exempt status to the program. 

(c) Exceptions, —(1) Veterans’ Administration. 
These regulations do not apply to information on 
alcohol and drug abuse patients maintained in 
connection with the Veterans’ Administration 
provisions of hospital care, nursing home care, 
domiciliary care, and medical services under title 
38, United States Code. Those records are 
governed by 38 U.S.C. 4132 and regulations issued 
under that authority by the Administrator of 
Veterans’ Affairs. 

(2) Armed Forces. These regulations apply to any 
information described in paragraph (a) of this 
section which was obtained by any component of 
the Armed Forces during a period when the patient 
was subject to the Uniform Code of Military 
Justice except: 

(i) Any interchange of that information within the 
Armed Forces; and 

(ii) Any interchange of that information between 
the Armed Forces and those components of the 
Veterans Administration furnishing health care to 
veterans. 

(3) Communication within a program or between 
a program and an entity having direct 
administrative control over that program. The 
restrictions on disclosure in these regulations do not 
apply to communications of information between 
or among personnel having a need for the 
information in connection with their duties that 
arise out of the provision of diagnosis, treatment, 
or referral for treatment of alcohol or drug abuse if 
the communications are 


(i) Within a program or 

(ii) Between a program and an entity that has direct 
administrative control over the program. 

(4) Qualified Service Organizations. The 
restrictions on disclosure in these regulations do not 
apply to communications between a program and a 
qualified service organization of information needed 
by the organization to provide services to the 
program. 

(5) Crimes on program premises or against 
program personnel. The restrictions on disclosure 
and use in these regulations do not apply to 
communications from program personnel to law 
enforcement officers which— 

(i) Are directly related to a patient’s commission of 
a crime on the premises of the program or against 
program personnel or to a threat to commit such a 
crime; and 

(ii) Are limited to the circumstances of the incident, 
including the patient status of the individual 
committing or threatening to commit the crime, that 
individual’s name and address, and that individual’s 
last known whereabouts. 

(6) Reports of suspected child abuse and neglect. 
The restrictions on disclosure and use in these 
regulations do not apply to the reporting under 
State law of incidents of suspected child abuse and 
neglect to the appropriate State or local authorities. 
However, the restrictions continue to apply to the 
original alcohol or drug abuse patient records 
maintained by the program including their 
disclosure and use for civil or criminal proceedings 
which may arise out of the report of suspected 
child abuse and neglect. 
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(d) Applicability to recipients of information —(1) 
Restriction on use of information. The restriction 
on the use of any information subject to these 
regulations to initiate or substantiate any criminal 
charges against a patient or to conduct any criminal 
investigation of a patient applies to any person who 
obtains that information from a federally assisted 
alcohol or drug abuse program, regardless of the 
status of the person obtaining the information or of 
whether the information was obtained in 
accordance with these regulations. This restriction 
on use bars, among other things, the introduction 
of that information as evidence in a criminal 
proceeding and any other use of the information to 
investigate or prosecute a patient with respect to a 
suspected crime. Information obtained by 
undercover agents or informants (see § 2.17) or 
through patient access (see § 2.23) is subject to the 
restriction on use. 

(2) Restrictions on disclosures—Third party 
payers, administrative entities, and others. The 
restrictions on disclosure in these regulations apply 
to: 

(i) Third party payers with regard to records 
disclosed to them by federally assisted alcohol or 
drug abuse programs; 

(ii) Entities having direct administrative control 
over programs with regard to information 
communicated to them by the program under § 
2.12(c)(3); and 

(iii) Persons who receive patient records directly 
from a federally assisted alcohol or drug abuse 
program and who are notified of the restrictions on 
redisclosure of the records in accordance with § 
2.32 of these regulations. 

(e) Explanation of applicability —(1) Coverage. 
These regulations cover any information (including 
information on referral and intake) about alcohol 
and drug abuse patients obtained by a program (as 
the terms ‘ ‘patient’ ’ and ‘ ‘program’ ’ are defined in 
§ 2.11) if the program is federally assisted in any 
manner described in § 2.12(b). Coverage includes, 
but is not limited to, those treatment or 
rehabilitation programs, employee assistance 
programs, programs within general hospitals, based 
programs, and private practitioners who hold 
themselves out as providing, and provide alcohol or 
drug abuse diagnosis, treatment, or referral for 
treatment. However, these regulations would not 
apply, for example, to emergency room personnel 
who refer a patient to the intensive care unit for an 
apparent overdose, unless the primary function of 
such personnel is the provision of alcohol or drug 


abuse diagnosis, treatment or referral and they are 
identified as providing such services or the 
emergency room has promoted itself to the 
community as a provider of such services. 

(2) Federal assistance to program required. If a 
patient’s alcohol or drug abuse diagnosis, 
treatment, or referral for treatment is not provided 
by a program which is federally conducted, 
regulated or supported in a manner which 
constitutes Federal assistance under § 2.12(b), that 
patient’s record is not covered by these regulations. 
Thus, it is possible for an individual patient to 
benefit from Federal support and not be covered by 
the confidentiality regulations because the program 
in which the patient is enrolled is not federally 
assisted as defined in § 2.12(b). For example, if a 
Federal court placed an individual in a private for- 
profit program and made a payment to the program 
on behalf of that individual, that patient’s record 
would not be covered by these regulations unless 
the program itself received Federal assistance as 
defined by § 2.12(b). 

(3) Information to which restrictions are 
applicable. Whether a restriction is on use or 
disclosure affects the type of infoimation which 
may be available. The restrictions on disclosure 
apply to any infoimation which would identify a 
patient as an alcohol or drug abuser. The restriction 
on use of infoimation to bring criminal charges 
against a patient for a crime applies to any 
information obtained by the program for the 
puipose of diagnosis, treatment, or referral for 
treatment of alcohol or drug abuse. (Note that 
restrictions on use and disclosure apply to 
recipients of information under § 2.12(d).) 

(4) How type of diagnosis affects coverage. These 
regulations cover any record of a diagnosis 
identifying a patient as an alcohol or drug abuser 
which is prepared in connection with the treatment 
or referral for treatment of alcohol or drug abuse. A 
diagnosis prepared for the puipose of treatment or 
referral for treatment but which is not so used is 
covered by these regulations. The following are not 
covered by these regulations: 

(i) Diagnosis which is made solely for the purpose 
of providing evidence for use by law enforcement 
authorities; or 

(ii) A diagnosis of drug overdose or alcohol 
intoxication which clearly shows that the individual 
involved is not an alcohol or drug abuser (e.g., 
involuntary ingestion of alcohol or drugs or reaction 
to a prescribed dosage of one or more drugs). 
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[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987, as amended at 60 FR 22297, May 5, 1995] 

§ 2.13 Confidentiality restrictions. 

(a) General. The patient records to which these 
regulations apply may be disclosed or used only as 
permitted by these regulations and may not 
otherwise be disclosed or used in any civil, 
criminal, administrative, or legislative proceedings 
conducted by any Federal, State, or local authority. 
Any disclosure made under these regulations must 
be limited to that information which is necessary to 
carry out the putpose of the disclosure. 

(b) Unconditional compliance required. The 
restrictions on disclosure and use in these 
regulations apply whether the holder of the 
information believes that the person seeking the 
information already has it, has other means of 
obtaining it, is a law enforcement or other official, 
has obtained a subpoena, or asserts any other 
justification for a disclosure or use which is not 
permitted by these regulations. 

(c) Acknowledging the presence of patients: 
Responding to requests. (1) The presence of an 
identified patient in a facility or component of a 
facility which is publicly identified as a place where 
only alcohol or drug abuse diagnosis, treatment, or 
referral is provided may be acknowledged only if 
the patient’s written consent is obtained in 
accordance with subpart C of these regulations or if 
an authorizing court order is entered in accordance 
with subpart E of these regulations. The regulations 
permit acknowledgment of the presence of an 
identified patient in a facility or pail of a facility if 
the facility is not publicly identified as only an 
alcohol or drug abuse diagnosis, treatment or 
referral facility, and if the acknowledgment does 
not reveal that the patient is an alcohol or drug 
abuser. 

(2) Any answer to a request for a disclosure of 
patient records which is not permissible under these 
regulations must be made in a way that will not 
affirmatively reveal that an identified individual has 
been, or is being diagnosed or treated for alcohol or 
drug abuse. An inquiring party may be given a 
copy of these regulations and advised that they 
restrict the disclosure of alcohol or drug abuse 
patient records, but may not be told affirmatively 
that the regulations restrict the disclosure of the 
records of an identified patient. The regulations do 


not restrict a disclosure that an identified individual 
is not and never has been a patient. 

§ 2.14 Minor patients. 

(a) Definition of minor. As used in these 
regulations the term “minor” means a person who 
has not attained the age of majority specified in the 
applicable State law, or if no age of majority is 
specified in the applicable State law, the age of 
eighteen years. 

(b) State law not requiring parental consent to 
treatment. If a minor patient acting alone has the 
legal capacity under the applicable State law to 
apply for and obtain alcohol or drug abuse 
treatment, any written consent for disclosure 
authorized under subpart C of these regulations 
may be given only by the minor patient. This 
restriction includes, but is not limited to, any 
disclosure of patient identifying information to the 
parent or guardian of a minor patient for the 
purpose of obtaining financial reimbursement. 

These regulations do not prohibit a program from 
refusing to provide treatment until the minor patient 
consents to the disclosure necessary to obtain 
reimbursement, but refusal to provide treatment 
may be prohibited under a State or local law 
requiring the program to furnish the service 
irrespective of ability to pay. 

(c) State law requiring parental consent to 
treatment. (1) Where State law requires consent of 
a parent, guardian, or other person for a minor to 
obtain alcohol or drug abuse treatment, any written 
consent for disclosure authorized under subpart C 
of these regulations must be given by both the 
minor and his or her parent, guardian, or other 
person authorized under State law to act in the 
minor’s behalf. 

(2) Where State law requires parental consent to 
treatment the fact of a minor’s application for 
treatment may be communicated to the minor’s 
parent, guardian, or other person authorized under 
State law to act in the minor’s behalf only if: 

(i) The minor has given written consent to the 
disclosure in accordance with subpart C of these 
regulations or 

(ii) The minor lacks the capacity to make a rational 
choice regarding such consent as judged by the 
program director under paragraph (d) of this 
section. 
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(d) Minor applicant for services lacks capacity for 
rational choice. Facts relevant to reducing a threat 
to the life or physical well being of the applicant or 
any other individual may be disclosed to the parent, 
guardian, or other person authorized under State 
law to act in the minor’s behalf if the program 
director judges that: 

(1) A minor applicant for services lacks capacity 
because of extreme youth or mental or physical 
condition to make a rational decision on whether to 
consent to a disclosure under subpart C of these 
regulations to his or her parent, guardian, or other 
person authorized under State law to act in the 
minor’s behalf, and 

(2) The applicant’s situation poses a substantial 
threat to the life or physical well being of the 
applicant or any other individual which may be 
reduced by communicating relevant facts to the 
minor’s parent, guardian, or other person 
authorized under State law to act in the minor’s 
behalf. 

§ 2.15 Incompetent and deceased patients. 

(a) Incompetent patients other than minors —(1) 
Adjudication of incompetence. In the case of a 
patient who has been adjudicated as lacking the 
capacity, for any reason other than insufficient age, 
to manage his or her own affairs, any consent 
which is required under these regulations may be 
given by the guardian or other person authorized 
under State law to act in the patient’s behalf. 

(2) No adjudication of incompetency. For any 
period for which the program director determines 
that a patient, other than a minor or one who has 
been adjudicated incompetent, suffers from a 
medical condition that prevents knowing or 
effective action on his or her own behalf, the 
program director may exercise the right of the 
patient to consent to a disclosure under subpart C 
of these regulations for the sole purpose of 
obtaining payment for services from a third party 
payer. 

(b) Deceased patients —(1) Vital statistics. These 
regulations do not restrict the disclosure of patient 
identifying information relating to the cause of 
death of a patient under laws requiring the 
collection of death or other vital statistics or 
permitting inquiry into the cause of death. 

(2) Consent by personal representative. Any other 
disclosure of information identifying a deceased 
patient as an alcohol or drug abuser is subject to 
these regulations. If a written consent to the 


disclosure is required, that consent may be given by 
an executor, administrator, or other personal 
representative appointed under applicable State 
law. If there is no such appointment the consent 
may be given by the patient’s spouse or, if none, 
by any responsible member of the patient’s family. 


§ 2.16 Security for written records. 

(a) Written records which are subject to these 
regulations must be maintained in a secure room, 
locked file cabinet, safe or other similar container 
when not in use; and 

(b) Each program shall adopt in writing procedures 
which regulate and control access to and use of 
written records which are subject to these 
regulations. 
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§ 2.17 Undercover agents and informants. 

(a) Restrictions on placement. Except as 
specifically authorized by a court order granted 
under § 2.67 of these regulations, no program may 
knowingly employ, or enroll as a patient, any 
undercover agent or informant. 

(b) Restriction on use of information. No 
information obtained by an undercover agent or 
informant, whether or not that undercover agent or 
informant is placed in a program pursuant to an 
authorizing court order, may be used to criminally 
investigate or prosecute any patient. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.18 Restrictions on the use of identification 
cards. 

N o person may require any patient to carry on his or 
her person while away from theprogram premises any 
card or other obi ect which would identify the patient as 
an alcohol or drug abuser. T his section does not prohibit 
a person from requiring patients to use or carry cards 
or other identification objects on the premises of a 
program. 

§ 2.19 Disposition of records by discontinued 
programs. 

(a) General. If a program discontinues operations 
or is taken over or acquired by another program, it 
must purge patient identifying information from its 
records or destroy the records unless— 

(1) T he patient who is thesubi ect of the records gives 
written consent (meeting thereguirements of § 2.31) to a 
transfer of therecords to theacguiring program or to 
any other program designated in the consent (the 
manner of obtaining this consent must minimize the 
likelihood of a disclosure of patient identifying 
information to a third party); or 

(2) Thereisa legal reguirement that the records be 
kept for a period specified by law which does not expire 
until after the discontinuation or acguisition of the 
program. 

(b) Procedure where retention period required by 
law. If paragraph (a)(2) of this section applies, the 
records must be: 

(1) Sealed in envelopes or other containers labeled 
as follows: “Records of [insert name of program] 
required to be maintained under [insert citation to 


statute, regulation, court order or other legal 
authority requiring that records be kept] until a date 
not later than [insert appropriate date] ’ ’; and 
(2) Held under the restrictions of these regulations 
by a responsible person who must, as soon as 
practicable after the end of the retention period 
specified on the label, destroy the records. 

§ 2.20 Relationship to State laws. 

The statutes authorizing these regulations (42 
U.S.C. 290ee-3 and 42 U.S.C. 290dd-3) do not 
preempt the field of law which they cover to the 
exclusion of all State laws in that field. If a 
disclosure permitted under these regulations is 
prohibited under State law, neither these regulations 
nor the authorizing statutes may be construed to 
authorize any violation of that State law. However, 
no State law may either authorize or compel any 
disclosure prohibited by these regulations. 

§ 2.21 Relationship to Federal statutes pro¬ 
tecting research subjects against compulsory 
disclosure of their identity. 

(a) Research privilege description. There may be 
concurrent coverage of patient identifying 
information by these regulations and by 
administrative action taken under: Section 303(a) of 
the Public Health Service Act (42 U.S.C. 242a(a) 
and the implementing regulations at 42 CFR part 
2a); or section 502(c) of the Controlled Substances 
Act (21 U.S.C. 872(c) and the implementing 
regulations at 21 CFR 1316.21). These "research 
privilege” statutes confer on the Secretary of 
Health and Human Services and on the Attorney 
General, respectively, the power to authorize 
researchers conducting certain types of research to 
withhold from all persons not connected with the 
research the names and other identifying 
information concerning individuals who are the 
subjects of the research. 

(b) Effect of concurrent coverage. These 
regulations restrict the disclosure and use of 
information about patients, while administrative 
action taken under the research privilege statutes 
and implementing regulations protects a person 
engaged in applicable research from being 
compelled to disclose any identifying characteristics 
of the individuals who are the subjects of that 
research. The issuance under subpart E of these 
regulations of a court order authorizing a disclosure 
of information about a patient does not affect an 
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exercise of authority under these research privilege 
statutes. However, the research privilege granted 
under 21 CFR 291.505(g) to treatment programs 
using methadone for maintenance treatment does 
not protect from compulsory disclosure any 
information which is permitted to be disclosed 
under those regulations. Thus, if a court order 
entered in accordance with subpart E of these 
regulations authorizes a methadone maintenance 
treatment program to disclose certain information 
about its patients, that program may not invoke the 
research privilege under 21 CFR 291.505(g) as a 
defense to a subpoena for that information. 

§ 2.22 Notice to patients of Federal 
confidentiality requirements. 

(a) Notice required. At the time of admission or as 
soon thereafter as the patient is capable of rational 
communication, each program shall: 

(1) Communicate to the patient that Federal law 
and regulations protect the confidentiality of 
alcohol and drug abuse patient records; and 

(2) Give to the patient a summaiy in writing of the 
Federal law and regulations. 

(b) Required elements of written summary. The 
written summary of the Federal law and regulations 
must include: 

(1) A general description of the limited 
circumstances under which a program may 
acknowledge that an individual is present at a 
facility or disclose outside the program information 
identifying a patient as an alcohol or drug abuser. 

(2) A statement that violation of the Federal law 
and regulations by a program is a crime and that 
suspected violations may be reported to appropriate 
authorities in accordance with these regulations. 

(3) A statement that information related to a 
patient’s commission of a crime on the premises of 
the program or against personnel of the program is 
not protected. 

(4) A statement that reports of suspected child 
abuse and neglect made under State law to 
appropriate State or local authorities are not 
protected. 

(5) A citation to the Federal law and regulations. 

(c) Program options. The program may devise its 
own notice or may use the sample notice in 
paragraph (d) to comply with the requirement to 
provide the patient with a summary in writing of 
the Federal law and regulations. In addition, the 
program may include in the written summaiy 


information concerning State law and any program 
policy not inconsistent with State and Federal law 
on the subject of confidentiality of alcohol and drug 
abuse patient records. 

(d) Sample notice. 

CONFIDENTIALITY OF ALCOHOL AND DRUG 
ABUSE PATIENT RECORDS 


The confidentiality of 
alcohol and drug abuse patient 
records maintained by this 
program is protected by Federal 
law and regulations. Generally, 
the program may not say to a 
person outside the program that 
a patient attends the program, 
or disclose any information 
identifying a patient as an 
alcohol or drug abuser Unless: 

(1) The patient consents in writing: 

(2) The disclosure is allowed by a court order; or 

(3) The disclosure is made to medical personnel 
in a medical emergency or to qualified personnel for 
research, audit, or program evaluation. Violation of the 
Federal law and regulations by a program is a crime. 
Suspected violations may be reported to appropriate 
authorities in accordance with Federal regulations. 
Federal law and regulations do not protect any 
information about a crime committed by a patient 
either at the program or against any person who works 
for the program or about any threat to commit such a 
crime. Federal laws and regulations do not protect any 
information about suspected child abuse or neglect 
from being reported under State law to appropriate 
State or local authorities. 


(See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for 
Federal laws and 42 CFR part 2 for Federal regulations.) 
(Approved by the Office of Management and Budget 
under control number 0930-0099) 

§ 2.23 Patient access and restrictions on use. 

(a) Patient access not prohibited. These regulations do 
not prohibit a program from giving a patient access to 
his or her own records, including the opportunity to 
inspect and copy any records that the program maintains 
about the patient. The program is not required to obtain 
a patient's written consent or other authorization under 
these regulations in order to provide such access to the 
patient. 
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(b) Restriction on use of information. Information 
obtained by patient access to his or her patient record is 
subject to the restriction on use of his information to 
initiate or substantiate any criminal charges against the 
patient or to conduct any criminal investigation of the 
patient as provided for under § 2.12(d)(1). 


Subpart C—Disclosures With Patient’s 
Consent 

§ 2.31 Form of written consent. 

(a) Required elements. A written consent to a disclosure 
under these regulations must include: 

(1) The specific name or general designation of the 

program or person permitted to make the 
disclosure. 

(2) The name or title of the individual or the name 
of the organization to which disclosure is to be 

made. 

(3) The name of the patient. 

(4) The purpose of the disclosure. 

(5) How much and what kind of information is to 
be disclosed. 

(6) The signature of the patient and, when required 
for a patient who is a minor, the signature of a 
person authorized to give consent under § 2.14; or, 
when required for a patient who is incompetent or 
deceased, the signature of a person authorized to 
sign under § 2.15 in lieu of the patient. 

(7) The date on which the consent is signed. 

(8) A statement that the consent is subject to 
revocation at any time except to the extent that the 
program or person which is to make the disclosure 

has already acted in reliance on it. Acting in 
reliance includes the provision of treatment services 
in reliance on a valid consent to disclose 
information to a third party payer. 

(9) The date, event, or condition upon which the 
consent will expire if not revoked before. This 
date, event, or condition must insure that the 
consent will last no longer than reasonably 
necessary to serve the purpose for which it is 
given. 

(b) Sample consent form. The following form complies 
with paragraph (a) of this section, but other elements 
may be added. 

1.1 (name of patient) 


0 Request Q Authorize: 


2. (name or general designation of pro gram which 
is to make the disclosure) 


3. To disclose: (kind and amount of information to 
be disclosed) 


4. To :(name or title of the person or organization 
to which disclosure is to be made) 


5. For: (purpose of the disclosure) 


6. Date: (on which this consent is signed) 


7. Signature of patient 


8. Signature of parent or guardian (where required ) 


9. Signature of person authorized to sign in lieu of 
the patient (where required) 


10. This consent is subject to revocation at any time 
except to the extent that the program which is to make 
the disclosure has already taken action in reliance on it. 
If not previously revoked, this consent will terminate 
upon: (specific date, event, or condition) 


(c) Expired, deficient, or false consent. A disclosure 
may not be made on the basis of a consent which: 

(1) Has expired; 

(2) On its face substantially fails to conform to 
any of the requirements set forth in paragraph (a) of 
this section; 

(3) Is known to have been revoked; or 

(4) Is known, or through a reasonable effort 
could be known, by the person holding the records to 
be materially false. 

(Approved by the Office of Management and Budget 
under control number 0930-0099) 

§ 2.32 Prohibition on redisclosure. 

Notice to accompany disclosure. Each dis¬ 
closure made with the patient’s written consent must 
be accompanied by the following written statement: 
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This information has been disclosed to you from 
records protected by Federal confidentiality rules (42 
CFR part 2). The Federal rules prohibit you from making 
any further disclosure of this information unless further 
disclosure is expressly permitted by the written consent 
of the person to whom it pertains or as otherwise 
permitted by 42 CFR part 2. A general authorization for 
the release of medical or other information is NOT 
sufficient for this purpose. The Federal rules restrict any 
use of the information to criminally investigate or 
prosecute any alcohol or drug abuse patient. 

[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2, 
1987] 

§ 2.33 Disclosures permitted with written consent. 

If a patient consents to a disclosure of his or her 
records under § 2.31, a program may disclose those 
records in accordance with that consent to any 
individual or organization named in the consent, 
except that disclosures to central registries and in 
connection with criminal justice referrals must meet 
the requirements of §§ 2.34 and 2.35, respectively. 

§ 2.34 Disclosures to prevent multiple enroll¬ 
ments in detoxification and maintenance 
treatment programs. 

(a) Definitions. For purposes of this section: 

Central registry means an organization which 
obtains from two or more member programs patient 
identifying information about individuals applying for 
maintenance treatment or detoxification treatment for 
the purpose of avoiding an individual's concurrent 
enrollment in more than one program. 

Detoxification treatment means the dispensing 
of a narcotic drug in decreasing doses to an individual 
in order to reduce or eliminate adverse physiological 
or psychological effects incident to withdrawal from 
the sustained use of a narcotic drug. 

Maintenance treatment means the 
dispensing of a narcotic drug in the treatment of 
an individual for dependence upon heroin or 
other morphine-like drugs. 

Member program means a detoxification 
treatment or maintenance treatment program 
which reports patient identifying information to 
a central registry and which is in the same State 
as that central registry or is not more than 125 
miles from any border of the State in which the 
central registry is located. 


(b) Restrictions on disclosure. A program may 
disclose patient records to a central registry or to any 
detoxification or maintenance treatment program not 
more than 200 miles away for the purpose of 
preventing the multiple enrollment of a patient only if: 

(1) The disclosure is made when: 

(i) The patient is accepted for treatment; 

(ii) The type or dosage of the drug is changed; or 

(iii) The treatment is interrupted, resumed or 
terminated. 

(2) The disclosure is limited to: 

(i) Patient identifying information; 

(ii) Type and dosage of the drug; and 

(iii) Relevant dates. 

(3) The disclosure is made with the patient's written 
consent meeting the requirements of §2.31, except 
that: 

(i) The consent must list the name and address of each 
central registry and each known detoxification or 
maintenance treatment program to which a disclosure 
will be made; and 

(ii) The consent may authorize a disclosure to any 
detoxification or maintenance treatment program 
established within 200 miles of the program after the 
consent is given without naming any such program. 

(c) Use of information limited to prevention of 
multiple enrollments. A central registry and any 
detoxification or maintenance treatment program to 
which information is disclosed to prevent multiple 
enrollments may not redisclose or use patient 
identifying information for any puipose other than 
the prevention of multiple enrollments unless 
authorized by a court order under subpart E of these 
regulations. 

(d) Permitted disclosure by a central registry to 
prevent a multiple enrollment. When a member 
program asks a central registry if an identified patient 
is enrolled in another member program and the 
registry determines that the patient is so enrolled, the 
registry may disclose— 

(1) The name, address, and telephone number of the 
member program(s) in which the patient is already 
enrolled to the inquiring member program; and 

(2) The name, address, and telephone number of the 
inquiring member program to the member program(s) in 
which the patient is already enrolled. The member 
programs may communicate as necessary to verify that 
no error has been made and to prevent or eliminate any 
multiple enrollment. 
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(e) Permitted disclosure by a detoxification or 
maintenance treatment program to prevent a 
multiple enrollment. A detoxification or maintenance 
treatment program which has received a disclosure 
under this section and has determined that the patient 
is already enrolled may communicate as necessary 
with the program making the disclosure to verify that 
no error has been made and to prevent or eliminate 
any multiple enrollment. 

§ 2.35 Disclosures to elements of the criminal 
justice system which have referred patients. 

(a) A program may disclose information about a 
patient to those persons within the criminal justice 
system which have made participation in the program 
a condition of the disposition of any criminal 
proceedings against the patient or of the patient’s 
parole or other release from custody if: 

(1) The disclosure is made only to those individuals 
within the criminal justice system who have a need for 
the information in connection with their duty to 
monitor the patient's progress (e.g., a prosecuting 
attorney who is withholding charges against the 
patient, a court granting pretrial or posttrial release, 
probation or parole officers responsible for supervision 
of the patient); and (2) The patient has signed a 
written consent meeting the requirements of § 2.31 
(except paragraph (a)(8) which is inconsistent with the 
revocation provisions of paragraph (c) of this section) 
and the requirements of paragraphs (b) and (c) of this 
section. 

(b) Duration of consent. The written consent must 
state the period during which it remains in effect. 
This period must be reasonable, taking into account: 

(1) The anticipated length of the treatment; 

(2) The type of criminal proceeding involved, the 
need for the information in connection with the final 
disposition of that proceeding, and when the final 
disposition will occur; and 

(3) Such other factors as the program, the patient, 
and the person(s) who will receive the disclosure 
consider pertinent. 

(c) Revocation of consent. The written consent must 
state that it is revocable upon the passage of a 
specified amount of time or the occurrence of a 
specified, ascertainable event. The time or 
occurrence upon which consent becomes revocable 
may be no later than the final disposition of the 
conditional release or other action in connection with 
which consent was given. 

(d) Restrictions on redisclosure and use. A person 


who receives patient information under this section 
may redisclose and use it only to carry out that 
person’s official duties with regard to the patient’s 
conditional release or other action in connection with 
which the consent was given. 


Subpart D—Disclosures Without Patient 
Consent 

§ 2.51 Medical emergencies. 

(a) General Rule. Under the procedures required 
by paragraph (c) of this section, patient identifying 
information may be disclosed to medical personnel 
who have a need for information about a patient 
for the purpose of treating a condition which poses 
an immediate threat to the health of any individual 
and which requires immediate medical intervention. 

(b) Special Rule. Patient identifying infoimation 
may be disclosed to medical personnel of the Food 
and Drug Administration (FDA) who assert a 
reason to believe that the health of any individual 
may be threatened by an error in the manufacture, 
labeling, or sale of a product under FDA 
jurisdiction, and that the infoimation will be used 
for the exclusive purpose of notifying patients or 
their physicians of potential dangers. 

(c) Procedures. Immediately following disclosure, the 
program shall document the disclosure in the 
patient’s records, setting forth in writing: 

(1) The name of the medical personnel to whom 
disclosure was made and their affiliation with any 
health care facility; 

(2) The name of the individual making the disclosure; 

(3) The date and time of the disclosure; and 

(4) The nature of the emergency (or error, if the 
report was to FDA). 

(Approved by the Office of Management and Budget 
under control number 0930-0099) 
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§ 2.52 Research activities. 

(a) Patient identifying information may be disclosed 
for the purpose of conducting scientific research if 
the program director makes a determination that the 
recipient of the patient identifying information: 

(1) Is qualified to conduct the research; 

(2) Has a research protocol under which the patient 
identifying information: 

(i) Will be maintained in accordance with the security 
requirements of § 2.16 of these regulations (or more 
stringent requirements); and 

(ii) Will not be redisclosed except as permitted under 
paragraph (b) of this section; and 

(3) Has provided a satisfactory written statement 
that a group of three or more individuals who are 
independent of the research project has reviewed 
the protocol and determined that: 

(i) The rights and welfare of patients will be 
adequately protected; and 

(ii) The risks in disclosing patient identifying 
information are outweighed by the potential benefits 
of the research. 

(b) A person conducting research may disclose 
patient identifying information obtained under 
paragraph (a) of this section only back to the 
program from which that information was obtained 
and may not identify any individual patient in any 
report of that research or otherwise disclose patient 
identities. 

[52 FR 21809, June 9, 1987, as amended at 52 FR 
41997, Nov. 2, 1987] 

§ 2.53 Audit and evaluation activities. 

(a) Records not copied or removed. If patient 
records are not copied or removed, patient identifying 
information may be disclosed in the course of a 
review of records on program premises to any person 
who agrees in writing to comply with the limitations 
on redisclosure and use in paragraph (d) of this 
section and who: 

(1) Performs the audit or evaluation activity on behalf 
of: 

(1) Any Federal, State, or local governmental agency 
which provides f inancial assistance to the program or is 
authorized by law to regulate its activities; or 

(ii) Any private person which provides financial 
assistanceto the program, which is a third party payer 
covering patients in the program, or which is a peer 
review organization performing a utilization or quality 
control review; or 

(2) Is determined by the program director to be 
qualified to conduct the audit or evaluation activities. 


(b) Copying or removal of records. Records 
containing patient identifying information may be 
copied or removed from program premises by any 
person who: 

(1) Agrees in writing to: 

(1) Maintain the patient identifying information in 
accordance with the security requirements provided in 
§ 2.16 of these regulations (or more stringent requirements); 

(ii) Destroy all the patient identifying information upon 
completion of the audit or evaluation; and 

(iii) Comply with the limitations on disclosure and use in 
paragraph (d) of this section; and 

(2) Performs the audit or evaluation activity on behalf 
of: 

(1) Any Federal, State, or local governmental agency 
which provides financial assistanceto the program or is 
authorized by law to regulate its activities; or 

(ii) Any private person which provides financial 
assistance to the program, which is a third part payer 
covering patients in the program, or which is a peer 
review organization performing a utilization or quality 
control review. 

(c) Medicare or Medicaid audit or evaluation. (1) 
For purposes of Medicare or Medicaid audit or 
evaluation under this section, audit or evaluation 
includes a civil or administrative investigation of the 
program by any Federal, State, or local agency 
responsible for oversight of the Medicare or Medicaid 
program and includes administrative enforcement, 
against the program by the agency, of any remedy 
authorized by law to be imposed as a result of the 
findings of the investigation. 

(2) Consistent with the definition of program in § 2.11, 
program includes an employee of, or provider of medical 
services under, the program when the employee or 
provider is the subject of a civil investigation or 
administrative remedy, as those terms are used in 
paragraph (c)(1) of this section. 

(3) If a disclosure to a person is authorized under this 
section for a Medicare or Medicaid audit or evaluation, 
including a civil investigation or administrative remedy, 
as those terms are used in paragraph (c)(1) of this 
section, then a peer review organization which obtains 
the inf ormation under paragraph (a) or (b) may disclose 
the inf ormation to that person but only for purposes of 
Medicare or Medicaid audit or evaluation. 

(4) The provisions of this paragraph do not authorize 
the agency, the program, or any other person to 
disclose or use patient identifying information obtained 
during the audit or evaluation for any purposes other than 
those necessary to complete the Medicare or Medicaid audit or 
evaluation activity as specified in this paragraph. 

(d) Limitations on disclosure and use. Except as 
provided in paragraph (c) of this section, patient 
identifying information disclosed under this section 
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may be disclosed only back to the program from 
which it was obtained and used only to carry out an 
audit or evaluation purpose or to investigate or 
prosecute criminal or other activities, as authorized 
by a court order entered under § 2.66 of these 
regulations. 

Subpart E—Court Orders 
Authorizing Disclosure and Use 

§ 2.61 Legal effect of order. 

(a) Effect. An order of a court of competent 
jurisdiction entered under this subpart is a unique 
kind of court order. Its only puipose is to authorize 
a disclosure or use of patient information which 
would otherwise be prohibited by 42 U.S.C. 
290ee-3, 42 U.S.C. 290dd-3 and these regulations. 
Such an order does not compel disclosure. A 
subpoena or a similar legal mandate must be issued 
in order to compel disclosure. This mandate may be 
entered at the same time as and accompany an 
authorizing court order entered under these 
regulations. 

(b) Examples. (1) A person holding records subject 
to these regulations receives a subpoena for those 
records: a response to the subpoena is not permitted 
under the regulations unless an authorizing court 
order is entered. The person may not disclose the 
records in response to the subpoena unless a court of 
competent jurisdiction enters an authorizing order 
under these regulations. 

(2) An authorizing court order is entered under 
these regulations, but the person authorized does 
not want to make the disclosure. I f there is no 
subpoena or other compulsory process or a 
subpoena for the records has expired or been 
quashed, that person may refuse to make the 
disclosure. Upon the entry of a valid subpoena or 
other compulsory process the person authorized to 
disclose must disclose, unless there is a valid legal 
defense to the process other than the confi¬ 
dentiality restrictions of these regulations. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.62 Order not applicable to records disclosed 
without consent to researchers, auditors and 
evaluators. 

A court order under these regulations may not 


authorize qualified personnel, who have received 
patient identifying information without consent for 
the purpose of conducting research, audit or 
evaluation, to disclose that information or use it to 
conduct any criminal investigation or prosecution of 
a patient. However, a court order under § 2.66 may 
authorize disclosure and use of records to 
investigate or prosecute qualified personnel holding 
the records. 

§ 2.63 Confidential communications. 

(a) A court order under these regulations may 
authorize disclosure of confidential communications 
made by a patient to a program in the course of 
diagnosis, treatment, or referral for treatment only 
if: 

(1) The disclosure is necessary to protect against 
an existing threat to life or of serious bodily 
injury, including circumstances which constitute 
suspected child abuse and neglect and verbal 
threats against third parties; 

(2) The disclosure is necessary in connection 
with investigation or prosecution of an extremely 
serious crime, such as one which directly 
threatens loss of life or serious bodily injury, 
including homicide, rape, kidnaping, armed 
robbery, assault with a deadly weapon, or child 
abuse and neglect; or 

(3) The disclosure is in connection with litigation 
or an administrative proceeding in which the 
patient offers testimony or other evidence 
pertaining to the content of the confidential 
communications. 

(b) [Reserved] 

§ 2.64 Procedures and criteria for orders 
authorizing disclosures for noncriminal 
purposes. 

(a) Application. An order authorizing the disclosure 
of patient records for purposes other than criminal 
investigation or prosecution may be applied for by 
any person having a legally recognized interest in 
the disclosure which is sought. The application may 
be filed separately or as pail of a pending civil 
action in which it appears that the patient records 
are needed to provide evidence. An application 
must use a fictitious name, such as John Doe, to 
refer to any patient and may not contain or 
otherwise disclose any patient identifying 
infoimation unless the patient is the applicant or 
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has given a written consent (meeting the 
requirements of these regulations) to disclosure or 
the court has ordered the record of the proceeding 
sealed from public scrutiny. 

(b) Notice. The patient and the person holding the 
records from whom disclosure is sought must be 
given: 

(1) Adequate notice in a manner which will not 
disclose patient identifying information to other 
persons; and 

(2) An opportunity to file a written response to 
the application, or to appear in person, for the 
limited purpose of providing evidence on the 
statutory and regulatory criteria for the issuance 

of the court order. 


(c) Review of evidence: Conduct of hearing. Any 
oral argument, review of evidence, or hearing on 
the application must be held in the judge’s 
chambers or in some manner which ensures that 
patient identifying information is not disclosed to 
anyone other than a party to the proceeding, the 
patient, or the person holding the record, unless the 
patient requests an open hearing in a manner which 
meets the written consent requirements of these 
regulations. The proceeding may include an 
examination by the judge of the patient records 
referred to in the application. 

(d) Criteria for entry of order. An order under this 
section may be entered only if the court determines 
that good cause exists. To make this determination 
the court must find that: 

(1) Other ways of obtaining the information are 
not available or would not be effective; and 

(2) The public interest and need for the 
disclosure outweigh the potential injury to the 
patient, the physician-patient relationship and 
the treatment services. 

(e) Content of order. An order authorizing a 
disclosure must: 

(1) Limit disclosure to those parts of the patient’s 
record which are essential to fulfill the objective 
of the order; 

(2) Limit disclosure to those persons whose need 
for information is the basis for the order; and 

(3) I nclude such other measures as are necessary 
to limit disclosure for the protection of the 
patient, the physician patient relationship and the 
treatment services; for example, sealing 

from public scrutiny the record of any proceeding 
for which disclosure of a patient’s record has been 
ordered. 

§ 2.65 Procedures and criteria for orders 
authorizing disclosure and use of records to 
criminally investigate or prosecute patients. 

(a) Application. An order authorizing the disclosure 
or use of patient records to criminally investigate or 
prosecute a patient may be applied for by the 
person holding the records or by any person 
conducting investigative or prosecutorial activities 
with respect to the enforcement of criminal laws. 
The application may be filed separately, as part of 
an application for a subpoena or other compulsory 
process, or in a pending criminal action. An 
application must use a fictitious name such as John 
Doe, to refer to any patient and may not contain or 
otherwise disclose patient identifying information 
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unless the court has ordered the record of the 
proceeding sealed from public scrutiny. 

(b) Notice and hearing. Unless an order under § 
2.66 is sought with an order under this section, the 
person holding the records must be given: 

(1) Adequate notice (in a manner which will not 

disclose patient identifying information to third 
parties) of an application by a person performing 
a law enforcement function; 

(2) An opportunity to appear and be heard for the 
limited purpose of providing evidence on the 
statutory and regulatory criteria for the issuance 
of the court order; and 

(3) An opportunity to be represented by counsel 
independent of counsel for an applicant who is a 
person performing a law enforcement function. 

(c) Review of evidence: Conduct of hearings. Any 
oral argument, review of evidence, or hearing on 
the application shall be held in the judge's 
chambers or in some other manner which ensures 
that patient identifying information is not disclosed 
to anyone other than a party to the proceedings, 
the patient, or the person holding the records. The 
proceeding may include an examination by the 
judge of the patient records referred to in the 
application. 

(d) Criteria. A court may authorize the disclosure 
and use of patient records for the purpose of 
conducting a criminal investigation or prosecution 
of a patient only if the court finds that all of the 
following criteria are met: 

(1) The crime involved is extremely serious, such 
as one which causes or directly threatens loss of 
life or serious bodily injury including homicide, 
rape, kidnaping, armed robbery, assault with a 
deadly weapon, and child abuse and neglect. 

(2) There is a reasonable likelihood that the 
records will disclose information of substantial 
value in the investigation or prosecution. 

(3) Other ways of obtaining the information are 
not available or would not be effective. 


(4) The potential injury to the patient, to the 
physician-patient relationship and to the 
ability of the program to provide services to 
other patients is outweighed by the public 
interest and the need for the disclosure. 

(5) I f the applicant is a person performing a law 
enforcement function that: 

(i) The person holding the records has been 
afforded the opportunity to be represented by 
independent counsel; and 

(ii) Any person holding the records which is an 
entity within Federal, State, or local government 
has in fact been represented by counsel 
independent of the applicant. 

(e) Content of order. Any order authorizing a 
disclosure or use of patient records under this 
section must: 

(1) Limit disclosure and use to those parts of the 
patient’s record which are essential to fulfill the 
objective of the order; 

(2) Limit disclosure to those law enforcement and 
prosecutorial officials who are responsible for, or 
are conducting, the investigation or prosecution, 
and limit their use of the records to investigation 
and prosecution of extremely serious crime or 
suspected crime specified in the application; and 

(3) I nclude such other measures as are necessary 
to limit disclosure and use to the fulfillment of 
only that public interest and need found by the 
court. 

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 
1987] 

§ 2.66 Procedures and criteria for orders 
authorizing disclosure and use of records to 
investigate or prosecute a program or the 
person holding the records. 

(a) Application. (1) An order authorizing the 
disclosure or use of patient records to criminally or 
administratively investigate or prosecute a program 
or the person holding the records (or employees or 
agents of that program or person) may be applied 
for by any administrative, regulatory, supervisory, 
investigative, law enforcement, or prosecutorial 
agency having jurisdiction over the program’s or 
person’s activities. 

(2) The application may be filed separately or as 
part of a pending civil or criminal action against a 
program or the person holding the records (or 
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agents or employees of the program or person) in 
which it appears that the patient records are 
needed to provide material evidence. The 
application must use a fictitious name, such as 
J ohn Doe, to refer to any patient and may not 
contain or otherwise disclose any patient 
identifying information unless the court has 
ordered the record of the proceeding sealed from 
public scrutiny or the patient has given a written 
consent (meeting the requirements of § 2.31 of 
these regulations) to that disclosure. 

(b) Notice not required. An application under this 
section may, in the discretion of the court, be 
granted without notice. Although no express notice 
is required to the program, to the person holding 
the records, or to any patient whose records are to 
be disclosed, upon implementation of an order so 
granted any of the above persons must be afforded 
an opportunity to seek revocation or amendment of 
that order, limited to the presentation of evidence 
on the statutory and regulatory criteria for the 
issuance of the court order. 

(c) Requirements for order. An order under this 
section must be entered in accordance with, and 
comply with the requirements of, paragraphs (d) 
and (e) of § 2.64 of these regulations. 

(d) Limitations on disclosure and use of patient 
identifying information: 

(1) An order entered under this section must 
require the deletion of patient identifying 
information from any documents made available 
to the public. 

(2) No information obtained under this section 
may be used to conduct any investigation or 
prosecution of a patient, or be used as the basis 
for an application for an order under § 2.65 of 

these regulations. 

§ 2.67 Orders authorizing the use of undercover 
agents and informants to criminally investigate 
employees or agents of a program. 

(a) Application. A court order authorizing the 
placement of an undercover agent or informant in a 
program as an employee or patient may be applied 
for by any law enforcement or prosecutorial 
agency which has reason to believe that employees 
or agents of the program are engaged in criminal 
misconduct. 


(b) Notice. The program director must be given 
adequate notice of the application and an 
opportunity to appear and be heard (for the limited 
puipose of providing evidence on the statutory and 
regulatory criteria for the issuance of the court 
order), unless the application asserts a belief that: 

(1) The program director is involved in the 
criminal activities to be investigated by the 
undercover agent or informant; or 

(2) The program director will intentionally or 
unintentionally disclose the proposed placement 
of an undercover agent or informant to the 
employees or agents who are suspected of 
criminal activities. 

(c) Criteria. An order under this section may be 
entered only if the court determines that good 
cause exists. To make this determination the court 
must find: 

(1) There is reason to believe that an employee 
or agent of the program is engaged in criminal 
activity; 

(2) Other ways of obtaining evidence of this 
criminal activity are not available or would not be 
effective; and 

(3) The public interest and need for the 
placement of an undercover agent or informant in 
the program outweigh the potential injury to 
patients of the program, physician-patient 
relationships and the treatment services. 

(d) Content of order. An order authorizing the 
placement of an undercover agent or informant in a 
program must: 

(1) Specifically authorize the placement of an 
undercover agent or an informant; 

(2) Limit the total period of the placement to six 
months; 

(3) Prohibit the undercover agent or informant 
from disclosing any patient identifying 
information obtained from the placement except 
as necessary to criminally investigate or 
prosecute employees or agents of the program; 
and 
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(4) I nclude any other measures which are 
appropriate to limit any potential disruption of 
the program by the placement and any potential 
for a real or apparent breach of patient 
confidentiality; for example, sealing from public 
scrutiny the record of any proceeding for which 
disclosure of a patient’s record has been ordered. 

(e) Limitation on use of information. No 
information obtained by an undercover agent or 
informant placed under this section may be used to 
criminally investigate or prosecute any patient or as 
the basis for an application for an order under § 
2.65 of these regulations. 
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A ppendix B— Sample Forms 
and AgreementsTo Facilitate Collaborative 
Efforts Between the Substance Abuse 
Treatment and Welfare Systems 


A-23 



Sample Form #1: 

Patient Consent for the Release of Confidential Information 


Patient Consent for the Release of Confidential Information 

i,_ / aneDoe _, 

authorize 

(NAME OF PATIENT) 

_ AB CTreatmentProqram 

(NAME OR GENERAL DESIGNATION OF PROGRAM MAKING DISCLOSURE) 

to disclose to _ M ary R oeor another TAN I FF counselor 

(NAME OF PERSON OR ORGANIZATION TO WHICH 
DISCLOSURE IS TO BE MADE) 

the following information: my attendance and compliancein substance abuse 
treatment_ 


(NATURE OF THE INFORMATION, AS LIMITED AS POSSIBLE) 

The purpose of the disclosure authorized herein is to: A ssist the H ill Co. D ept of 
W elfareto determinemy eligibility for benefits and/or to evaluatemy 
readiness/ability to participate in a training program. 

(PURPOSE OF DISCLOSURE, AS SPECIFIC AS POSSIBLE) 

I understand that my records are protected under the Federal regulations governing Confidentiali y 
of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be disclosed without my 
written consent unless otherwise provided for in the regulations. I also understand that I may revi ke 
this consent at any time except to the extent that action has been taken in reliance on it, and that n 
any event this consent expires automatically as follows: 


(SPECIFICATION OF THE DATE, EVENT, OR CONDITION UPON WHICH THIS CONSENT 
EXPIRES) 

Dated:_ 


(Signature of Participant) 


(Signature of Parent, 
Guardian or Authorized 
Representative, When 
Required,) 
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Sample Form #2: 

Multiparty Consent Form 


Multiparty Consent Form 


authorize 


(NAME OF PATIENT) 


(NAME OR GENERAL DESIGNATION OF PROGRAM MAKING DISCLOSURE) 
to disclose to: (the following persons or organizations) 


1 ._ 

2 . 

3. 


The purpose of the disclosure authorized herein is to: permit the participants of a 
case conference concerning my case to exchange information with one another. 

I understand that my records are protected under the Federal regulations governing Confidentiality df 
Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be disclosed without my writtem 
consent unless otherwise provided for in the regulations. I also understand that I may revoke this comsent 
at any time except to the extent that action has been taken in reliance on it, and that in any event thi| 
consent expires automatically as follows: 


(SPECIFICATION OF THE DATE, EVENT, OR CONDITION UPON WHICH THIS CONSENT EXPIRES) 


(DATE) 


(SIGNATURE OF PARTICIPANT) 


(SIGNATURE OF PARENT, GUARDIAN OR 
AUTHORIZED REPRESENTATIVE IF REQUIRED) 
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Sample Form #3: 


Prohibition on Redisclosure of Information Concerning Client 
in Alcohol or Drug Abuse Treatment 


The following notice accompanies a disclosure of information concerning a 
client in alcohol/drug abuse treatment, made to you with the consent of such 
client. 


Prohibition on Redisclosure of Information 
Concerning Client in Alcohol or Drug Abuse Treatment 

This information has been disclosed to you from records protected by Federal 
confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from 
making any further disclosure of this information unless further disclosure is 
expressly permitted by the written consent of the person to whom it pertains 
or as otherwise permitted by 42 CFR Part 2. A general authorization for the 
release of medical or other information is NOT sufficient for this purpose. The 
Federal rules restrict any use of the information to criminally investigate or 
prosecute any alcohol or drug abuse patient. 


B-4 







Sample Form #4: 

Qualified Service Organization Agreement 


Qualified Service Organization Agreement 


XYZ Service Center ("the Center") and 


(NAME OF THE PROGRAM) 

("the Program") hereby enter into a qualified service organization agreement, 
whereby the Center agrees to provide 


(NATURE OF SERVICES TO BE PROVIDED) 

Furthermore, the Center: 

(1) acknowledges that in receiving, storing, processing, or otherwise dealing with any 
information from the Program about the patients in the Program, it is fully bound by the 
provisions of the Federal regulations governing Confidentiality of Alcohol and Drug Abuse 
Patient Records, 42 CFR Part 2; and 

(2) undertakes to resist in judicial proceedings any effort to obtain access to information 
pertaining to patients otherwise than as expressly provided for in the Federal confidentiality 
regulations, 42 CFR Part 2. 


Executed this_day of_, 199 


President 

XYZ Service Center 
[address] 


Program Director 
[Name of the Program] 
[address] 
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